From 00a6171b8de5863a54ba81e597fa4edbee65fd8e Mon Sep 17 00:00:00 2001 From: Vadim Yanitskiy Date: Fri, 30 Aug 2019 21:00:22 +0200 Subject: [PATCH] gtp_update_pdp_ind(): fix NULL-pointer dereference As stated in the comment above, we need to use the tunnel identifier to find a GTP context, and derive both IMSI and NSAPI from that TID, when speaking GTP version 0. This change fixes the following warnings (found with Clang): gtp.c:2115:22: warning: variable 'pdp' is uninitialized when used here [-Wuninitialized] pdp_set_imsi_nsapi(pdp, tid); ^^^ gtp.c:2118:34: warning: variable 'imsi' is uninitialized when used here [-Wuninitialized] if (gtp_pdp_getimsi(gsn, &pdp, imsi, nsapi)) ^^^^ gtp.c:2118:40: warning: variable 'nsapi' is uninitialized when used here [-Wuninitialized] if (gtp_pdp_getimsi(gsn, &pdp, imsi, nsapi)) ^^^^^ Change-Id: I8f1c8d0ba2e8189d97fe1bb5c872680e5ad1cd7a --- gtp/gtp.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/gtp/gtp.c b/gtp/gtp.c index 88248d1..7cb82b6 100644 --- a/gtp/gtp.c +++ b/gtp/gtp.c @@ -2084,12 +2084,8 @@ static int gtp_update_pdp_ind(struct gsn_t *gsn, uint8_t version, /* For GTP1 we must use imsi and nsapi if imsi is present. Otherwise */ /* we have to use the tunnel endpoint identifier */ if (version == 0) { - uint64_t tid = be64toh(((union gtp_packet *)pack)->gtp0.h.tid); - - pdp_set_imsi_nsapi(pdp, tid); - /* Find the context in question */ - if (gtp_pdp_getimsi(gsn, &pdp, imsi, nsapi)) { + if (gtp_pdp_tidget(gsn, &pdp, get_tid(pack))) { gsn->err_unknownpdp++; GTP_LOGPKG(LOGL_ERROR, peer, pack, len, "Unknown PDP context\n"); @@ -2097,6 +2093,9 @@ static int gtp_update_pdp_ind(struct gsn_t *gsn, uint8_t version, len, NULL, GTPCAUSE_NON_EXIST); } + + /* Update IMSI and NSAPI */ + pdp_set_imsi_nsapi(pdp, get_tid(pack)); } else if (version == 1) { /* NSAPI (mandatory) */ if (gtpie_gettv1(ie, GTPIE_NSAPI, 0, &nsapi)) {