Originally reported by Guido Casati on 2026-05-12 — GitLab #1091
Reported by chris@mode51.software in the mailing list:
When nrUE invokes decode_registration_accept the logic that decodes the optional IEs crashes when used with a commercial gNB.
The last IE in the Registration Accept is NSSAI inclusion mode which is expressed as a single byte.
The default case in the while loop in decode_registration_accept attempts to skip unsupported IEs but there are a couple of problems:
- in the default case for an unsupported (by nrUE) IE the second byte after the element ID is treated as the length and this is then incremented by 1. This is ok for other element IDs, where the next byte usually is the length, but not for the single byte NSSAI inclusion mode. It is also the last element so the length is actually then read from beyond the end of the buffer.
- the while loop exits when ba.len < 0. ba is a byte_array_t, len is a size_t, which is unsigned. The processing carries on when a malformed/unknown IE causes ba.len to have been decremented below 0.
The loop needs a more robust bounds check and should discard malformed/unsupported IEs.
Reported by chris@mode51.software in the mailing list:
When nrUE invokes decode_registration_accept the logic that decodes the optional IEs crashes when used with a commercial gNB.
The last IE in the Registration Accept is NSSAI inclusion mode which is expressed as a single byte.
The default case in the while loop in decode_registration_accept attempts to skip unsupported IEs but there are a couple of problems:
- in the default case for an unsupported (by nrUE) IE the second byte after the element ID is treated as the length and this is then incremented by 1. This is ok for other element IDs, where the next byte usually is the length, but not for the single byte NSSAI inclusion mode. It is also the last element so the length is actually then read from beyond the end of the buffer.
- the while loop exits when ba.len < 0. ba is a byte_array_t, len is a size_t, which is unsigned. The processing carries on when a malformed/unknown IE causes ba.len to have been decremented below 0.
The loop needs a more robust bounds check and should discard malformed/unsupported IEs.