gtp: fix OOB write in PDP ctx GSN-Address decode

gtp_decode_pdp_ctx() takes the GSN-Address sub-field lengths of a PDP
Context IE (gsnrc / gsnru, the GGSN control- and user-plane addresses)
straight from the wire and memcpy()s that many bytes into the fixed
16-byte 'struct ul16_t' v[] array, with no check against the destination
size. decode_pdp_ctx_len_check() only validates the declared lengths
against the *input* buffer, never against the destination capacity, so a
wire length of 17..255 overflows the 16-byte field by up to 239 bytes,
clobbering adjacent struct pdp_t state.

The PDP Context IE is carried in SGSN Context Response / Forward
Relocation messages exchanged between peer GSNs over Gn/Gp, so a
malicious or spoofed peer GSN can trigger this. The same libgtp decoder
is linked by osmo-sgsn, so it is affected as well.

A GSN address is 4 (IPv4) or 16 (IPv6) bytes, so reject any length that
does not fit the destination before copying.

This issue has been assigned the CVE candidate identifier
CAN-2026-2051035.

Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98
---
M gtp/gtp.c
1 file changed, 12 insertions(+), 0 deletions(-)