CVE-2022-3299 (C, published 2022-09-26T13:15Z)
Description: value: A vulnerability was found in Open5GS up to 2.4.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality in the library lib/sbi/client.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. The name of the patch is 724fa568435dae45ef0c3a48b2aabde052afae88. It is recommended to apply a patch to fix this issue. The identifier VDB-209545 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/open5gs/open5gs
Files changed:
lib/sbi/client.c
lib/sbi/nghttp2-server.c
Commit message: Fixed HTTP2 crashes for random JSON data (#1769)


Vulnerable code:
                ogs_debug("[%d:%s] %s",
                ogs_debug("RECEIVED[%d]", (int)response->http.content_length);
                    ogs_debug("%s", response->http.content);
                if (content_type)
                    ogs_sbi_header_set(response->http.headers,
                            OGS_SBI_CONTENT_TYPE, content_type);
                if (conn->location)
                    ogs_sbi_header_set(response->http.headers,
                            OGS_SBI_LOCATION, conn->location);
        ogs_fatal("not enough memory (realloc returned NULL)");
        ogs_assert_if_reached();
            ogs_debug("[%s] %s", request->h.method, request->h.uri);
                ogs_debug("RECEIVED: %d", (int)request->http.content_length);
                ogs_debug("%s", request->http.content);
        request->http.content_length = len;
        request->http.content =
            (char*)ogs_malloc(request->http.content_length + 1);
        ogs_assert(request->http.content);
        offset = request->http.content_length;
        if ((request->http.content_length + len) > OGS_HUGE_LEN) {
            ogs_error("Overflow : Content-Length[%d], len[%d]",
                        (int)request->http.content_length, (int)len);
            ogs_assert_if_reached();
        }
        request->http.content_length += len;
        request->http.content = (char *)ogs_realloc(
                request->http.content, request->http.content_length + 1);
        ogs_assert(request->http.content);

Fixed code:
    bool memory_overflow;
                ogs_log_level_e level = OGS_LOG_DEBUG;

                if (content_type)
                    ogs_sbi_header_set(response->http.headers,
                            OGS_SBI_CONTENT_TYPE, content_type);
                if (conn->location)
                    ogs_sbi_header_set(response->http.headers,
                            OGS_SBI_LOCATION, conn->location);

                if (conn->memory_overflow == true)
                    level = OGS_LOG_ERROR;

                ogs_log_message(level, 0, "[%d:%s] %s",
                ogs_log_message(level, 0, "RECEIVED[%d]",
                        (int)response->http.content_length);
                    ogs_log_message(level, 0, "%s", response->http.content);

                if (conn->memory_overflow == true) {
                    ogs_sbi_response_free(response);
                    connection_remove(conn);
                    break;
                }
        conn->memory_overflow = true;

        ogs_error("Overflow : conn->size[%d], realsize[%d]",
                    (int)conn->size, (int)realsize);
        ogs_log_hexdump(OGS_LOG_ERROR, contents, realsize);

    bool                    memory_overflow;
            ogs_log_level_e level = OGS_LOG_DEBUG;
            if (stream->memory_overflow == true)
                level = OGS_LOG_ERROR;

            ogs_log_message(level, 0,
                    "[%s] %s", request->h.method, request->h.uri);
                ogs_log_message(level, 0,
                        "RECEIVED: %d", (int)request->http.content_length);
                ogs_log_message(level, 0, "%s", request->http.content);
            }

            if (stream->memory_overflow == true) {
                ogs_error("[DROP] Overflow");
                break;
        ogs_assert(request->http.content_length == 0);
        ogs_assert(offset == 0);

        request->http.content = (char*)ogs_malloc(len + 1);
        ogs_assert(request->http.content_length != 0);

        request->http.content = (char*)ogs_realloc(
                request->http.content, request->http.content_length + len + 1);
    if (!request->http.content) {
        stream->memory_overflow = true;

        ogs_error("Overflow : Content-Length[%d], len[%d]",
                    (int)request->http.content_length, (int)len);
        ogs_log_hexdump(OGS_LOG_ERROR, data, len);

        return 0;
    }

    offset = request->http.content_length;
    request->http.content_length += len;