From ec14a6e50bf962967be833b0c071a033e422cf63 Mon Sep 17 00:00:00 2001
From: Francisco <francisco.paisana@softwareradiosystems.com>
Date: Tue, 2 Feb 2021 19:23:11 +0000
Subject: [PATCH] verify correctness of input to gtpu::write_pdu

---
 srsenb/hdr/stack/upper/gtpu.h  |  3 ++-
 srsenb/src/stack/upper/gtpu.cc | 17 ++++++++++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/srsenb/hdr/stack/upper/gtpu.h b/srsenb/hdr/stack/upper/gtpu.h
index 5e9c91218..09c0d192e 100644
--- a/srsenb/hdr/stack/upper/gtpu.h
+++ b/srsenb/hdr/stack/upper/gtpu.h
@@ -133,7 +133,8 @@ private:
    ***************************************************************************/
   uint32_t next_teid_in = 0;
 
-  tunnel* get_tunnel(uint32_t teidin);
+  tunnel*                get_tunnel(uint32_t teidin);
+  srslte::span<uint32_t> get_lcid_teids(uint16_t rnti, uint32_t lcid);
 
   void log_message(tunnel& tun, bool is_rx, srslte::span<uint8_t> pdu, int pdcp_sn = -1);
 };
diff --git a/srsenb/src/stack/upper/gtpu.cc b/srsenb/src/stack/upper/gtpu.cc
index 775b8b36d..e12b83d2a 100644
--- a/srsenb/src/stack/upper/gtpu.cc
+++ b/srsenb/src/stack/upper/gtpu.cc
@@ -90,7 +90,11 @@ void gtpu::stop()
 // gtpu_interface_pdcp
 void gtpu::write_pdu(uint16_t rnti, uint32_t lcid, srslte::unique_byte_buffer_t pdu)
 {
-  tunnel& tx_tun = tunnels[ue_teidin_db.at(rnti)[lcid][0]];
+  srslte::span<uint32_t> teids = get_lcid_teids(rnti, lcid);
+  if (teids.empty()) {
+    return;
+  }
+  tunnel& tx_tun = tunnels[teids[0]];
   log_message(tx_tun, false, srslte::make_span(pdu));
   send_pdu_to_tunnel(tx_tun, std::move(pdu));
 }
@@ -472,6 +476,17 @@ gtpu::tunnel* gtpu::get_tunnel(uint32_t teidin)
   return &it->second;
 }
 
+srslte::span<uint32_t> gtpu::get_lcid_teids(uint16_t rnti, uint32_t lcid)
+{
+  auto ue_it = ue_teidin_db.find(rnti);
+  if (ue_it == ue_teidin_db.end() or lcid < SRSENB_N_SRB or lcid >= SRSENB_N_RADIO_BEARERS or
+      ue_it->second[lcid].empty()) {
+    logger.error("Could not find bearer rnti=0x%x, lcid=%d\n", rnti, lcid);
+    return {};
+  }
+  return ue_it->second[lcid];
+}
+
 void gtpu::log_message(tunnel& tun, bool is_rx, srslte::span<uint8_t> pdu, int pdcp_sn)
 {
   fmt::basic_memory_buffer<char, 1024> strbuf;