Malformed messages can cause CU Crash

[sgarg00]

Originally reported by XIAOTIAN ZHOU on 2026-05-09 — GitLab #1089

Hi, similar to #1078, we found another batch of inputs that could cause the CUto crash. These are listed below:

1. Certain input can trigger the DevAssert(splmn->id == F1AP_ProtocolIE_ID_id_TAISliceSupportList); in the function read_slice_info in file openair2/F1AP/lib/f1ap_interface_management.c. For example, F1AP-PDU: 0001005200000400abd000150004e800200cc002a8006800d51ad3f13002c40360000002b003000008ad13451de71608000dd08782de9000067ea000400000220010030bab800020800401265550002a30000093001780

2. Certain input can trigger the Assertion Failure in function decode_up_tnl. Causing the macro BIT_STRING_TO_TRANSPORT_LAYER_ADDRESS_IPv4(&gtp_tnl->transportLayerAddress, out->tl_address); to fail. Example input message:
   4007002d000003001d001400001c000f2100039051ad3f1300000af000011000288005c03451de7100290005c0efa2b230 Or

<F1AP-PDU>
  <successfulOutcome>
    <procedureCode>7</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <UEContextModificationResponse>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>29</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <DRBs-SetupMod-List>
                <ProtocolIE-SingleContainer>
                  <id>28</id>
                  <criticality>
                    <reject/>
                  </criticality>
                  <value>
                    <DRBs-SetupMod-Item>
                      <dRBID>3</dRBID>
                      <dLUPTNLInformation-ToBeSetup-List>
                        <DLUPTNLInformation-ToBeSetup-Item>
                          <dLUPTNLInformation>
                            <gTPTunnel>
                              <transportLayerAddress>1001</transportLayerAddress>
                              <gTP-TEID>51AD3F13</gTP-TEID>
                            </gTPTunnel>
                          </dLUPTNLInformation>
                        </DLUPTNLInformation-ToBeSetup-Item>
                      </dLUPTNLInformation-ToBeSetup-List>
                      <iE-Extensions>
                        <ProtocolExtensionField>
                          <id>2800</id>
                          <criticality>
                            <reject/>
                          </criticality>
                          <extensionValue>10</extensionValue>
                        </ProtocolExtensionField>
                      </iE-Extensions>
                    </DRBs-SetupMod-Item>
                  </value>
                </ProtocolIE-SingleContainer>
              </DRBs-SetupMod-List>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>40</id>
            <criticality>
              <notify/>
            </criticality>
            <value>
              <GNB-CU-UE-F1AP-ID>877780593</GNB-CU-UE-F1AP-ID>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>41</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <GNB-DU-UE-F1AP-ID>4020417072</GNB-DU-UE-F1AP-ID>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </UEContextModificationResponse>
    </value>
  </successfulOutcome>
</F1AP-PDU>

3. Certain input can cause AssertFatal(NODE_IS_DU(node_type), "Should not have received F1AP_GNB_CU_CONFIGURATION_UPDATE in CU/gNB\n"); in function gNB_app_task in file openair2/GNB_APP/gnb_app.c.

Example input:
3f040009000001004e000200a2 or

<F1AP-PDU>
  <initiatingMessage>
    <procedureCode>4</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <GNBCUConfigurationUpdate>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>78</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <TransactionID>162</TransactionID>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </GNBCUConfigurationUpdate>
    </value>
  </initiatingMessage>
</F1AP-PDU>

4. Certain input can trigger DevAssert(os->size == sizeofArray(out->rrc_ver)); in decode_f1ap_setup_request in Targets/f1ap/openairinterface5g/openair2/F1AP/lib/f1ap_interface_management.c. Example input:
   0001002000000300ab000ad0000077cc80037d51ad004e00020013002a4005608ad13451 Or

<F1AP-PDU>
  <initiatingMessage>
    <procedureCode>1</procedureCode>
    <criticality>
      <reject/>
    </criticality>
    <value>
      <F1SetupRequest>
        <protocolIEs>
          <ProtocolIE-Field>
            <id>171</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <RRC-Version>
                <latest-RRC-Version>101</latest-RRC-Version>
                <iE-Extensions>
                  <ProtocolExtensionField>
                    <id>30668</id>
                    <criticality>
                      <notify/>
                    </criticality>
                    <extensionValue>7D51AD</extensionValue>
                  </ProtocolExtensionField>
                </iE-Extensions>
              </RRC-Version>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>78</id>
            <criticality>
              <reject/>
            </criticality>
            <value>
              <TransactionID>19</TransactionID>
            </value>
          </ProtocolIE-Field>
          <ProtocolIE-Field>
            <id>42</id>
            <criticality>
              <ignore/>
            </criticality>
            <value>
              <GNB-DU-ID>2328966225</GNB-DU-ID>
            </value>
          </ProtocolIE-Field>
        </protocolIEs>
      </F1SetupRequest>
    </value>
  </initiatingMessage>
</F1AP-PDU>