Admin message

Some repository views and data access features for public projects require sign-in. Please log in for full access.

Malformed messages can cause CU Crash
Hi, similar to #1078, we found another batch of inputs that could cause the CUto crash. These are listed below: 1. Certain input can trigger the ` DevAssert(splmn->id == F1AP_ProtocolIE_ID_id_TAISliceSupportList);` in the function `read_slice_info` in file `openair2/F1AP/lib/f1ap_interface_management.c`. For example, F1AP-PDU: `0001005200000400abd000150004e800200cc002a8006800d51ad3f13002c40360000002b003000008ad13451de71608000dd08782de9000067ea000400000220010030bab800020800401265550002a30000093001780` 2. Certain input can trigger the Assertion Failure in function `decode_up_tnl`. Causing the macro `BIT_STRING_TO_TRANSPORT_LAYER_ADDRESS_IPv4(&gtp_tnl->transportLayerAddress, out->tl_address); ` to fail. Example input message: `4007002d000003001d001400001c000f2100039051ad3f1300000af000011000288005c03451de7100290005c0efa2b230` Or ``` <F1AP-PDU> <successfulOutcome> <procedureCode>7</procedureCode> <criticality> <reject/> </criticality> <value> <UEContextModificationResponse> <protocolIEs> <ProtocolIE-Field> <id>29</id> <criticality> <reject/> </criticality> <value> <DRBs-SetupMod-List> <ProtocolIE-SingleContainer> <id>28</id> <criticality> <reject/> </criticality> <value> <DRBs-SetupMod-Item> <dRBID>3</dRBID> <dLUPTNLInformation-ToBeSetup-List> <DLUPTNLInformation-ToBeSetup-Item> <dLUPTNLInformation> <gTPTunnel> <transportLayerAddress>1001</transportLayerAddress> <gTP-TEID>51AD3F13</gTP-TEID> </gTPTunnel> </dLUPTNLInformation> </DLUPTNLInformation-ToBeSetup-Item> </dLUPTNLInformation-ToBeSetup-List> <iE-Extensions> <ProtocolExtensionField> <id>2800</id> <criticality> <reject/> </criticality> <extensionValue>10</extensionValue> </ProtocolExtensionField> </iE-Extensions> </DRBs-SetupMod-Item> </value> </ProtocolIE-SingleContainer> </DRBs-SetupMod-List> </value> </ProtocolIE-Field> <ProtocolIE-Field> <id>40</id> <criticality> <notify/> </criticality> <value> <GNB-CU-UE-F1AP-ID>877780593</GNB-CU-UE-F1AP-ID> </value> </ProtocolIE-Field> <ProtocolIE-Field> <id>41</id> <criticality> <reject/> </criticality> <value> <GNB-DU-UE-F1AP-ID>4020417072</GNB-DU-UE-F1AP-ID> </value> </ProtocolIE-Field> </protocolIEs> </UEContextModificationResponse> </value> </successfulOutcome> </F1AP-PDU> ``` 3. Certain input can cause `AssertFatal(NODE_IS_DU(node_type), "Should not have received F1AP_GNB_CU_CONFIGURATION_UPDATE in CU/gNB\n");` in function `gNB_app_task` in file `openair2/GNB_APP/gnb_app.c`. Example input: `3f040009000001004e000200a2` or ``` <F1AP-PDU> <initiatingMessage> <procedureCode>4</procedureCode> <criticality> <reject/> </criticality> <value> <GNBCUConfigurationUpdate> <protocolIEs> <ProtocolIE-Field> <id>78</id> <criticality> <reject/> </criticality> <value> <TransactionID>162</TransactionID> </value> </ProtocolIE-Field> </protocolIEs> </GNBCUConfigurationUpdate> </value> </initiatingMessage> </F1AP-PDU> ``` 4. Certain input can trigger `DevAssert(os->size == sizeofArray(out->rrc_ver));` in `decode_f1ap_setup_request` in `Targets/f1ap/openairinterface5g/openair2/F1AP/lib/f1ap_interface_management.c`. Example input: `0001002000000300ab000ad0000077cc80037d51ad004e00020013002a4005608ad13451` Or ``` <F1AP-PDU> <initiatingMessage> <procedureCode>1</procedureCode> <criticality> <reject/> </criticality> <value> <F1SetupRequest> <protocolIEs> <ProtocolIE-Field> <id>171</id> <criticality> <reject/> </criticality> <value> <RRC-Version> <latest-RRC-Version>101</latest-RRC-Version> <iE-Extensions> <ProtocolExtensionField> <id>30668</id> <criticality> <notify/> </criticality> <extensionValue>7D51AD</extensionValue> </ProtocolExtensionField> </iE-Extensions> </RRC-Version> </value> </ProtocolIE-Field> <ProtocolIE-Field> <id>78</id> <criticality> <reject/> </criticality> <value> <TransactionID>19</TransactionID> </value> </ProtocolIE-Field> <ProtocolIE-Field> <id>42</id> <criticality> <ignore/> </criticality> <value> <GNB-DU-ID>2328966225</GNB-DU-ID> </value> </ProtocolIE-Field> </protocolIEs> </F1SetupRequest> </value> </initiatingMessage> </F1AP-PDU> ```
issue