Malformed Messages can cause DU Crash
Hi, similar to #1078 and #1089, we found another batch of inputs that could cause the DU to crash. These are listed below:
1. Certain inputs can cause `AssertFatal(du_cell->nr_cellid == cu_cell->nr_cellid, "CellID mismatch: DU %ld vs CU %ld\n", du_cell->nr_cellid, cu_cell->nr_cellid);` in `f1_setup_response` in `openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c`.
Example input: `400100210000030003000f00000004000900226377cc867d51e000aa000120004e000200de` or
```
<F1AP-PDU>
<successfulOutcome>
<procedureCode>1</procedureCode>
<criticality>
<reject/>
</criticality>
<value>
<F1SetupResponse>
<protocolIEs>
<ProtocolIE-Field>
<id>3</id>
<criticality>
<reject/>
</criticality>
<value>
<Cells-to-be-Activated-List>
<ProtocolIE-SingleContainer>
<id>4</id>
<criticality>
<reject/>
</criticality>
<value>
<Cells-to-be-Activated-List-Item>
<nRCGI>
<pLMN-Identity>226377</pLMN-Identity>
<nRCellIdentity>110011001000011001111101010100011110</nRCellIdentity>
</nRCGI>
</Cells-to-be-Activated-List-Item>
</value>
</ProtocolIE-SingleContainer>
</Cells-to-be-Activated-List>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>170</id>
<criticality>
<reject/>
</criticality>
<value>
<RRC-Version>
<latest-RRC-Version>010</latest-RRC-Version>
</RRC-Version>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>78</id>
<criticality>
<reject/>
</criticality>
<value>
<TransactionID>222</TransactionID>
</value>
</ProtocolIE-Field>
</protocolIEs>
</F1SetupResponse>
</value>
</successfulOutcome>
</F1AP-PDU>
```
2. Certain inputs can cause:
`AssertFatal(1==0,"received gNB CU CONFIGURATION UPDATE FAILURE with cause %d\n", GNBCUConfigurationUpdateFailure->cause)` in `DU_send_gNB_CU_CONFIGURATION_UPDATE_FAILURE` in `openair2/F1AP/f1ap_du_interface_management.c`.
Example input: `0004001c0000020003000f00000004000900226377cc867d51e0004e0002008a` or
```
<F1AP-PDU>
<initiatingMessage>
<procedureCode>4</procedureCode>
<criticality>
<reject/>
</criticality>
<value>
<GNBCUConfigurationUpdate>
<protocolIEs>
<ProtocolIE-Field>
<id>3</id>
<criticality>
<reject/>
</criticality>
<value>
<Cells-to-be-Activated-List>
<ProtocolIE-SingleContainer>
<id>4</id>
<criticality>
<reject/>
</criticality>
<value>
<Cells-to-be-Activated-List-Item>
<nRCGI>
<pLMN-Identity>226377</pLMN-Identity>
<nRCellIdentity>110011001000011001111101010100011110</nRCellIdentity>
</nRCGI>
</Cells-to-be-Activated-List-Item>
</value>
</ProtocolIE-SingleContainer>
</Cells-to-be-Activated-List>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>78</id>
<criticality>
<reject/>
</criticality>
<value>
<TransactionID>138</TransactionID>
</value>
</ProtocolIE-Field>
</protocolIEs>
</GNBCUConfigurationUpdate>
</value>
</initiatingMessage>
</F1AP-PDU>
```
3. Certain inputs can cause: `AssertFatal(cell_to_activate == 1,"No cells to activate or cells > 1 %d\n",cell_to_activate);` in `gNB_app_task` in `openair2/GNB_APP/gnb_app.c`.
Example input:
`0004001c0000020003000f00000004000900226377cc867d51e0004e0002008a` or
```
<F1AP-PDU>
<initiatingMessage>
<procedureCode>4</procedureCode>
<criticality>
<reject/>
</criticality>
<value>
<GNBCUConfigurationUpdate>
<protocolIEs>
<ProtocolIE-Field>
<id>3</id>
<criticality>
<reject/>
</criticality>
<value>
<Cells-to-be-Activated-List>
<ProtocolIE-SingleContainer>
<id>4</id>
<criticality>
<reject/>
</criticality>
<value>
<Cells-to-be-Activated-List-Item>
<nRCGI>
<pLMN-Identity>226377</pLMN-Identity>
<nRCellIdentity>110011001000011001111101010100011110</nRCellIdentity>
</nRCGI>
</Cells-to-be-Activated-List-Item>
</value>
</ProtocolIE-SingleContainer>
</Cells-to-be-Activated-List>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>78</id>
<criticality>
<reject/>
</criticality>
<value>
<TransactionID>138</TransactionID>
</value>
</ProtocolIE-Field>
</protocolIEs>
</GNBCUConfigurationUpdate>
</value>
</initiatingMessage>
</F1AP-PDU>
```
4. Certain input can trigger: `AssertFatal(is_SA ^ (cg_configinfo != NULL), "cannot have SA and CG-ConfigInfo: NR-DC not supported xor need CG-ConfigInfo for NSA/phy-test/do-ra\n");` in `ue_context_setup_request` in `openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c`.
Example input:
`000500260000040009000440029946006b000108003f0009002427226377cc86f000280005c0130af08a` or
``` <F1AP-PDU>
<initiatingMessage>
<procedureCode>5</procedureCode>
<criticality>
<reject/>
</criticality>
<value>
<UEContextSetupRequest>
<protocolIEs>
<ProtocolIE-Field>
<id>9</id>
<criticality>
<reject/>
</criticality>
<value>
<CUtoDURRCInformation>
<cG-ConfigInfo>9946</cG-ConfigInfo>
</CUtoDURRCInformation>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>107</id>
<criticality>
<reject/>
</criticality>
<value>
<ServCellIndex>2</ServCellIndex>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>63</id>
<criticality>
<reject/>
</criticality>
<value>
<NRCGI>
<pLMN-Identity>242722</pLMN-Identity>
<nRCellIdentity>011000110111011111001100100001101111</nRCellIdentity>
</NRCGI>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>40</id>
<criticality>
<reject/>
</criticality>
<value>
<GNB-CU-UE-F1AP-ID>319484042</GNB-CU-UE-F1AP-ID>
</value>
</ProtocolIE-Field>
</protocolIEs>
</UEContextSetupRequest>
</value>
</initiatingMessage>
</F1AP-PDU>
```
5. Some inputs can trigger `AssertFatal(rb != NULL, "SDU sent to unknown RB UE-ID %d SRB %d\n", ue_id, channel_id);` in `nr_rlc_srb_recv_sdu` in `openair2/LAYER2/nr_rlc/nr_rlc_oai_api.c`. Example input:
`0005002a000005000900010000320003022427006b000108003f0009006377cc867d51adc000280005c08ad13451` or
```
<F1AP-PDU>
<initiatingMessage>
<procedureCode>5</procedureCode>
<criticality>
<reject/>
</criticality>
<value>
<UEContextSetupRequest>
<protocolIEs>
<ProtocolIE-Field>
<id>9</id>
<criticality>
<reject/>
</criticality>
<value>
<CUtoDURRCInformation/>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>50</id>
<criticality>
<reject/>
</criticality>
<value>
<RRCContainer>2427</RRCContainer>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>107</id>
<criticality>
<reject/>
</criticality>
<value>
<ServCellIndex>2</ServCellIndex>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>63</id>
<criticality>
<reject/>
</criticality>
<value>
<NRCGI>
<pLMN-Identity>6377CC</pLMN-Identity>
<nRCellIdentity>100001100111110101010001101011011100</nRCellIdentity>
</NRCGI>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>40</id>
<criticality>
<reject/>
</criticality>
<value>
<GNB-CU-UE-F1AP-ID>2328966225</GNB-CU-UE-F1AP-ID>
</value>
</ProtocolIE-Field>
</protocolIEs>
</UEContextSetupRequest>
</value>
</initiatingMessage>
</F1AP-PDU>
```
6. Certain message may cause Null Pointer Dereference. In ` ue_cap = get_ue_nr_cap(*req->gNB_DU_ue_id, cu2du->ue_cap->buf, cu2du->ue_cap->len);` in function ue_context_setup_request, the `req->gNB_DU_ue_id` might be NULL.
Example input: `0005003b00000501020011010103000c5444800027161201867d51c0000900042002f21e006b000108003f0009000af08ad13451dea000280005c0b23076fd`
```
<F1AP-PDU>
<initiatingMessage>
<procedureCode>5</procedureCode>
<criticality>
<reject/>
</criticality>
<value>
<UEContextSetupRequest>
<protocolIEs>
<ProtocolIE-Field>
<id>258</id>
<criticality>
<reject/>
</criticality>
<value>
<BHChannels-ToBeSetup-List>
<ProtocolIE-SingleContainer>
<id>259</id>
<criticality>
<reject/>
</criticality>
<value>
<BHChannels-ToBeSetup-Item>
<bHRLCChannelID>1010001000100100</bHRLCChannelID>
<bHQoSInformation>
<bHRLCCHQoS>
<qoS-Characteristics>
<non-Dynamic-5QI>
<fiveQI>39</fiveQI>
</non-Dynamic-5QI>
</qoS-Characteristics>
<nGRANallocationRetentionPriority>
<priorityLevel>2</priorityLevel>
<pre-emptionCapability>
<may-trigger-pre-emption/>
</pre-emptionCapability>
<pre-emptionVulnerability>
<pre-emptable/>
</pre-emptionVulnerability>
</nGRANallocationRetentionPriority>
</bHRLCCHQoS>
</bHQoSInformation>
<rLCmode>
<rlc-am/>
</rLCmode>
<trafficMappingInfo>
<bAPlayerBHRLCchannelMappingInfo>
<bAPlayerBHRLCchannelMappingInfoToRemove>
<MappingInformationIndex>10000110011111010101000111</MappingInformationIndex>
</bAPlayerBHRLCchannelMappingInfoToRemove>
</bAPlayerBHRLCchannelMappingInfo>
</trafficMappingInfo>
</BHChannels-ToBeSetup-Item>
</value>
</ProtocolIE-SingleContainer>
</BHChannels-ToBeSetup-List>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>9</id>
<criticality>
<reject/>
</criticality>
<value>
<CUtoDURRCInformation>
<uE-CapabilityRAT-ContainerList>F21E</uE-CapabilityRAT-ContainerList>
</CUtoDURRCInformation>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>107</id>
<criticality>
<reject/>
</criticality>
<value>
<ServCellIndex>2</ServCellIndex>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>63</id>
<criticality>
<reject/>
</criticality>
<value>
<NRCGI>
<pLMN-Identity>0AF08A</pLMN-Identity>
<nRCellIdentity>110100010011010001010001110111101010</nRCellIdentity>
</NRCGI>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>40</id>
<criticality>
<reject/>
</criticality>
<value>
<GNB-CU-UE-F1AP-ID>2989520637</GNB-CU-UE-F1AP-ID>
</value>
</ProtocolIE-Field>
</protocolIEs>
</UEContextSetupRequest>
</value>
</initiatingMessage>
</F1AP-PDU>
```
7. `AssertFatal(1==0,"Unknown reset type\n");` can be triggered in `DU_handle_RESET`. Example input:
`000000170000030000000580a22400000030000100004e00020022` or
```
<F1AP-PDU>
<initiatingMessage>
<procedureCode>0</procedureCode>
<criticality>
<reject/>
</criticality>
<value>
<Reset>
<protocolIEs>
<ProtocolIE-Field>
<id>0</id>
<criticality>
<reject/>
</criticality>
<value>
<Cause>
<choice-extension>
<id>41508</id>
<criticality>
<reject/>
</criticality>
<value/>
</choice-extension>
</Cause>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>48</id>
<criticality>
<reject/>
</criticality>
<value>
<ResetType>
<f1-Interface>
<reset-all/>
</f1-Interface>
</ResetType>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>78</id>
<criticality>
<reject/>
</criticality>
<value>
<TransactionID>34</TransactionID>
</value>
</ProtocolIE-Field>
</protocolIEs>
</Reset>
</value>
</initiatingMessage>
</F1AP-PDU>
```
8. Assertion failure due to BIT_STRING size cannot convert to u64 or u32 in functions `BIT_STRING_to_uint64` and `BIT_STRING_to_uint32`.
Example inputs: `001200250000030071000f00000070000900a22427226377cc70007f0005603f134000007500027820` or
```
<F1AP-PDU>
<initiatingMessage>
<procedureCode>18</procedureCode>
<criticality>
<reject/>
</criticality>
<value>
<Paging>
<protocolIEs>
<ProtocolIE-Field>
<id>113</id>
<criticality>
<reject/>
</criticality>
<value>
<PagingCell-list>
<ProtocolIE-SingleContainer>
<id>112</id>
<criticality>
<reject/>
</criticality>
<value>
<PagingCell-Item>
<nRCGI>
<pLMN-Identity>A22427</pLMN-Identity>
<nRCellIdentity>001000100110001101110111110011000111</nRCellIdentity>
</nRCGI>
</PagingCell-Item>
</value>
</ProtocolIE-SingleContainer>
</PagingCell-list>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>127</id>
<criticality>
<reject/>
</criticality>
<value>
<PagingIdentity>
<cNUEPagingIdentity>
<choice-extension>
<id>16147</id>
<criticality>
<ignore/>
</criticality>
<value/>
</choice-extension>
</cNUEPagingIdentity>
</PagingIdentity>
</value>
</ProtocolIE-Field>
<ProtocolIE-Field>
<id>117</id>
<criticality>
<reject/>
</criticality>
<value>
<UEIdentityIndexValue>
<indexLength10>1111000001</indexLength10>
</UEIdentityIndexValue>
</value>
</ProtocolIE-Field>
</protocolIEs>
</Paging>
</value>
</initiatingMessage>
</F1AP-PDU>
```
9. Function `f1_setup_failure` in `openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c` would exit(1) on any F1SetupFailure from CU.
issue