- fixed - null pointer dereference in mmsServer_handleDeleteNamedVariableListRequest when receiving malformed message (LIB61850-430)

src/mms/iso_mms/server/mms_named_variable_list_service.c

@@ -130,16 +130,22 @@ mmsServer_handleDeleteNamedVariableListRequest(MmsServerConnection connection,
 		goto exit_function;
 	}
 
-	if ((mmsPdu->present == MmsPdu_PR_confirmedRequestPdu) &&
+    if ((mmsPdu->present == MmsPdu_PR_confirmedRequestPdu) &&
-		(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.present
+        (mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.present
-		== ConfirmedServiceRequest_PR_deleteNamedVariableList))
+        == ConfirmedServiceRequest_PR_deleteNamedVariableList))
-	{
+    {
-		request = &(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.choice.deleteNamedVariableList);
+        request = &(mmsPdu->choice.confirmedRequestPdu.confirmedServiceRequest.choice.deleteNamedVariableList);
-	}
+    }
-	else {
+    else {
-		mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response);
+        mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response);
-		goto exit_function;
+        goto exit_function;
-	}
+    }
+
+    if (request->listOfVariableListName == NULL)
+    {
+        mmsMsg_createMmsRejectPdu(&invokeId, MMS_ERROR_REJECT_INVALID_PDU, response);
+        goto exit_function;
+    }
  
 	long scopeOfDelete = DeleteNamedVariableListRequest__scopeOfDelete_specific;