From 43ec237a4fe29af9bb4c6cc009f809c3d1586248 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Mon, 20 Apr 2026 10:33:48 +0200 Subject: [PATCH] fix (NGAP): encode optional QoS list when not empty Only build QoSFlowAddOrModifyResponseList when at least one QFI is present and fail fast if PDUSessionResourceModifyResponseTransfer encoding does not produce a valid buffer. This avoids sending malformed modify responses and makes encoding failures explicit in the NGAP modify response path. Changes: - do QoS add/modify response list allocation when nb_of_qos_flow > 0 - add ASN.1 encode result validation Signed-off-by: Guido Casati --- openair3/NGAP/ngap_gNB_pdu_session_management.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/openair3/NGAP/ngap_gNB_pdu_session_management.c b/openair3/NGAP/ngap_gNB_pdu_session_management.c index 7c6dafebe3..8dcf22c37b 100644 --- a/openair3/NGAP/ngap_gNB_pdu_session_management.c +++ b/openair3/NGAP/ngap_gNB_pdu_session_management.c @@ -220,17 +220,24 @@ int ngap_gNB_pdusession_modify_resp(instance_t instance, ngap_pdusession_modify_ item->pDUSessionID = pdusession_modify_resp_p->pdusessions[i].pdusession_id; NGAP_PDUSessionResourceModifyResponseTransfer_t transfer = {0}; - asn1cCalloc(transfer.qosFlowAddOrModifyResponseList, tmp); - - for (int qos_flow_index = 0; qos_flow_index < pdusession_modify_resp_p->pdusessions[i].nb_of_qos_flow; qos_flow_index++) { - asn1cSequenceAdd(tmp->list, NGAP_QosFlowAddOrModifyResponseItem_t, qos); - qos->qosFlowIdentifier = pdusession_modify_resp_p->pdusessions[i].qos[qos_flow_index].qfi; + if (pdusession_modify_resp_p->pdusessions[i].nb_of_qos_flow > 0) { + asn1cCalloc(transfer.qosFlowAddOrModifyResponseList, tmp); + for (int qos_flow_index = 0; qos_flow_index < pdusession_modify_resp_p->pdusessions[i].nb_of_qos_flow; qos_flow_index++) { + asn1cSequenceAdd(tmp->list, NGAP_QosFlowAddOrModifyResponseItem_t, qos); + qos->qosFlowIdentifier = pdusession_modify_resp_p->pdusessions[i].qos[qos_flow_index].qfi; + } } asn_encode_to_new_buffer_result_t res = {0}; res = asn_encode_to_new_buffer(NULL, ATS_ALIGNED_CANONICAL_PER, &asn_DEF_NGAP_PDUSessionResourceModifyResponseTransfer, &transfer); + if (res.buffer == NULL || res.result.encoded <= 0) { + NGAP_ERROR("Failed to encode PDUSessionResourceModifyResponseTransfer for PDU session %ld\n", item->pDUSessionID); + ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_NGAP_PDUSessionResourceModifyResponseTransfer, &transfer); + ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_NGAP_NGAP_PDU, &pdu); + return -1; + } item->pDUSessionResourceModifyResponseTransfer.buf = res.buffer; item->pDUSessionResourceModifyResponseTransfer.size = res.result.encoded;