commit fe87809c92b6059b6b25c110b200a5d60c842f7b
author Neels Hofmeyr <nhofmeyr@sysmocom.de> Fri Nov 25 13:13:31 2016 +0100
committer Harald Welte <laforge@gnumonks.org> Sun Nov 27 18:27:32 2016 +0000
tree b5b5434a673461361e80bc1230d2c539be380f3e
parent e08cdd92a648ea8d9bb6ca405f04c91ca485db3c

hnbgw_rua: reject invalid domain indicator

Fixes: CID#135226, CID#135227
Change-Id: I0c44179aac02772585214e528207e959ad168f3c

src/hnbgw_rua.c

diff --git a/src/hnbgw_rua.c b/src/hnbgw_rua.c
index 3f245b5..ca745b1 100644
--- a/src/hnbgw_rua.c
+++ b/src/hnbgw_rua.c
@@ -347,6 +347,11 @@
 	case RUA_CN_DomainIndicator_ps_domain:
 		cn = hnb->gw->cnlink_ps;
 		break;
+	default:
+		LOGP(DRUA, LOGL_ERROR, "Invalid CN_DomainIndicator: %u\n",
+		     ies.cN_DomainIndicator);
+		rc = -1;
+		goto error_free;
 	}
 
 	if (ies.presenceMask & DISCONNECTIES_RUA_RANAP_MESSAGE_PRESENT) {
@@ -356,6 +361,8 @@
 
 	rc = rua_to_scu(hnb, cn, OSMO_SCU_PRIM_N_DISCONNECT,
 			context_id, scu_cause, ranap_data, ranap_len);
+
+error_free:
 	/* FIXME: what to do with the asn1c-allocated memory */
 	rua_free_disconnecties(&ies);
 
@@ -386,11 +393,18 @@
 	case RUA_CN_DomainIndicator_ps_domain:
 		cn = hnb->gw->cnlink_ps;
 		break;
+	default:
+		LOGP(DRUA, LOGL_ERROR, "Invalid CN_DomainIndicator: %u\n",
+		     ies.cN_DomainIndicator);
+		rc = -1;
+		goto error_free;
 	}
 
 	rc = rua_to_scu(hnb, cn, OSMO_SCU_PRIM_N_DATA,
 			context_id, 0, ies.ranaP_Message.buf,
 			ies.ranaP_Message.size);
+
+error_free:
 	/* FIXME: what to do with the asn1c-allocated memory */
 	rua_free_directtransferies(&ies);