CVE-2026-33903

@@ -90,6 +90,11 @@ func HandleLocationReport(ctx context.Context, amf *amfContext.AMF, ran *amfCont
 			break
 		}
 
+		if locationReportingRequestType.AreaOfInterestList == nil {
+			logger.WithTrace(ctx, ranUe.Log).Warn("AreaOfInterestList is nil, skipping area matching")
+			break
+		}
+
 		for _, uEPresenceInAreaOfInterestItem := range uEPresenceInAreaOfInterestList.List {
 			uEPresence := uEPresenceInAreaOfInterestItem.UEPresence.Value
 			referenceID := uEPresenceInAreaOfInterestItem.LocationReportingReferenceID.Value
@@ -109,6 +114,11 @@ func HandleLocationReport(ctx context.Context, amf *amfContext.AMF, ran *amfCont
 
 		logger.WithTrace(ctx, ranUe.Log).Info("sent location reporting control ngap message")
 	case ngapType.EventTypePresentStopUePresenceInAreaOfInterest:
+		if locationReportingRequestType.LocationReportingReferenceIDToBeCancelled == nil {
+			logger.WithTrace(ctx, ranUe.Log).Warn("LocationReportingReferenceIDToBeCancelled is nil, skipping")
+			break
+		}
+
 		logger.WithTrace(ctx, ranUe.Log).Debug("To stop reporting UE presence in the area of interest", zap.Int64("ReferenceID", locationReportingRequestType.LocationReportingReferenceIDToBeCancelled.Value))
 
 	case ngapType.EventTypePresentCancelLocationReportingForTheUe:

@@ -98,3 +98,120 @@ func TestHandleLocationReport_UePresenceInAreaOfInterest_NilList(t *testing.T) {
 		ngap.HandleLocationReport(context.Background(), amf, ran, msg)
 	})
 }
+
+// TestHandleLocationReport_StopUePresence_NilReferenceIDToBeCancelled verifies
+// that a LocationReport with EventType=StopUePresenceInAreaOfInterest but
+// without LocationReportingReferenceIDToBeCancelled does NOT panic.
+// Reproduces GHSA-f2f3-9cx3-wcmf Bug 1.
+func TestHandleLocationReport_StopUePresence_NilReferenceIDToBeCancelled(t *testing.T) {
+	ran := newTestRadio()
+	amf := newTestAMF()
+	ranUe := &amfContext.RanUe{
+		RanUeNgapID: 1,
+		AmfUeNgapID: 1,
+		Radio:       ran,
+		Log:         logger.AmfLog,
+	}
+	ran.RanUEs[1] = ranUe
+
+	msg := &ngapType.LocationReport{}
+
+	msg.ProtocolIEs.List = append(msg.ProtocolIEs.List, ngapType.LocationReportIEs{
+		Id:          ngapType.ProtocolIEID{Value: ngapType.ProtocolIEIDRANUENGAPID},
+		Criticality: ngapType.Criticality{Value: ngapType.CriticalityPresentReject},
+		Value: ngapType.LocationReportIEsValue{
+			Present:     ngapType.LocationReportIEsPresentRANUENGAPID,
+			RANUENGAPID: &ngapType.RANUENGAPID{Value: 1},
+		},
+	})
+
+	// EventType = StopUePresenceInAreaOfInterest, but
+	// LocationReportingReferenceIDToBeCancelled is nil (optional, omitted).
+	msg.ProtocolIEs.List = append(msg.ProtocolIEs.List, ngapType.LocationReportIEs{
+		Id:          ngapType.ProtocolIEID{Value: ngapType.ProtocolIEIDLocationReportingRequestType},
+		Criticality: ngapType.Criticality{Value: ngapType.CriticalityPresentIgnore},
+		Value: ngapType.LocationReportIEsValue{
+			Present: ngapType.LocationReportIEsPresentLocationReportingRequestType,
+			LocationReportingRequestType: &ngapType.LocationReportingRequestType{
+				EventType: ngapType.EventType{
+					Value: ngapType.EventTypePresentStopUePresenceInAreaOfInterest,
+				},
+				ReportArea: ngapType.ReportArea{
+					Value: ngapType.ReportAreaPresentCell,
+				},
+				// LocationReportingReferenceIDToBeCancelled deliberately nil
+			},
+		},
+	})
+
+	assertNoPanic(t, "HandleLocationReport(StopUePresence with nil ReferenceIDToBeCancelled)", func() {
+		ngap.HandleLocationReport(context.Background(), amf, ran, msg)
+	})
+}
+
+// TestHandleLocationReport_UePresence_NilAreaOfInterestList verifies that
+// a LocationReport with EventType=UePresenceInAreaOfInterest and a non-nil
+// UEPresenceInAreaOfInterestList but nil AreaOfInterestList does NOT panic.
+// Reproduces GHSA-f2f3-9cx3-wcmf Bug 2.
+func TestHandleLocationReport_UePresence_NilAreaOfInterestList(t *testing.T) {
+	ran := newTestRadio()
+	amf := newTestAMF()
+	ranUe := &amfContext.RanUe{
+		RanUeNgapID: 1,
+		AmfUeNgapID: 1,
+		Radio:       ran,
+		Log:         logger.AmfLog,
+	}
+	ran.RanUEs[1] = ranUe
+
+	msg := &ngapType.LocationReport{}
+
+	msg.ProtocolIEs.List = append(msg.ProtocolIEs.List, ngapType.LocationReportIEs{
+		Id:          ngapType.ProtocolIEID{Value: ngapType.ProtocolIEIDRANUENGAPID},
+		Criticality: ngapType.Criticality{Value: ngapType.CriticalityPresentReject},
+		Value: ngapType.LocationReportIEsValue{
+			Present:     ngapType.LocationReportIEsPresentRANUENGAPID,
+			RANUENGAPID: &ngapType.RANUENGAPID{Value: 1},
+		},
+	})
+
+	// EventType = UePresenceInAreaOfInterest with AreaOfInterestList nil (omitted).
+	msg.ProtocolIEs.List = append(msg.ProtocolIEs.List, ngapType.LocationReportIEs{
+		Id:          ngapType.ProtocolIEID{Value: ngapType.ProtocolIEIDLocationReportingRequestType},
+		Criticality: ngapType.Criticality{Value: ngapType.CriticalityPresentIgnore},
+		Value: ngapType.LocationReportIEsValue{
+			Present: ngapType.LocationReportIEsPresentLocationReportingRequestType,
+			LocationReportingRequestType: &ngapType.LocationReportingRequestType{
+				EventType: ngapType.EventType{
+					Value: ngapType.EventTypePresentUePresenceInAreaOfInterest,
+				},
+				ReportArea: ngapType.ReportArea{
+					Value: ngapType.ReportAreaPresentCell,
+				},
+				// AreaOfInterestList deliberately nil
+			},
+		},
+	})
+
+	// Provide a non-nil UEPresenceInAreaOfInterestList so the outer loop
+	// executes and the inner loop hits the nil AreaOfInterestList.
+	msg.ProtocolIEs.List = append(msg.ProtocolIEs.List, ngapType.LocationReportIEs{
+		Id:          ngapType.ProtocolIEID{Value: ngapType.ProtocolIEIDUEPresenceInAreaOfInterestList},
+		Criticality: ngapType.Criticality{Value: ngapType.CriticalityPresentIgnore},
+		Value: ngapType.LocationReportIEsValue{
+			Present: ngapType.LocationReportIEsPresentUEPresenceInAreaOfInterestList,
+			UEPresenceInAreaOfInterestList: &ngapType.UEPresenceInAreaOfInterestList{
+				List: []ngapType.UEPresenceInAreaOfInterestItem{
+					{
+						LocationReportingReferenceID: ngapType.LocationReportingReferenceID{Value: 1},
+						UEPresence:                   ngapType.UEPresence{Value: ngapType.UEPresencePresentIn},
+					},
+				},
+			},
+		},
+	})
+
+	assertNoPanic(t, "HandleLocationReport(UePresence with nil AreaOfInterestList)", func() {
+		ngap.HandleLocationReport(context.Background(), amf, ran, msg)
+	})
+}

@@ -96,6 +96,8 @@ func HandleNGReset(ctx context.Context, ran *amfContext.Radio, msg *ngapType.NGR
 				if ueAssociatedLogicalNGConnectionItem.RANUENGAPID != nil {
 					logger.WithTrace(ctx, ran.Log).Warn("RANUENGAPID is not empty", zap.Int64("RanUeNgapID", ueAssociatedLogicalNGConnectionItem.RANUENGAPID.Value))
 				}
+
+				continue
 			}
 
 			err := ranUe.Remove()

@@ -244,3 +244,37 @@ func TestHandleNGReset_EmptyIEs(t *testing.T) {
 		ngap.HandleNGReset(context.Background(), ran, msg)
 	})
 }
+
+// TestHandleNGReset_PartOfNGInterface_UnknownUE verifies that a PartOfNGInterface
+// reset referencing a RANUENGAPID that does not match any UE context does NOT
+// panic or remove the wrong UE. This exercises the missing-continue bug where
+// ranUe is nil after the lookup but Remove() is called anyway.
+func TestHandleNGReset_PartOfNGInterface_UnknownUE(t *testing.T) {
+	fakeNGAPSender := &FakeNGAPSender{}
+
+	ran := &amfContext.Radio{
+		Log:           logger.AmfLog,
+		NGAPSender:    fakeNGAPSender,
+		RanUEs:        map[int64]*amfContext.RanUe{},
+		SupportedTAIs: make([]amfContext.SupportedTAI, 0),
+	}
+
+	// Build an NGReset referencing a RANUENGAPID that doesn't exist.
+	msg, err := buildNGReset(&NGResetOpts{
+		ResetType: ResetTypePresentPartOfNGInterface,
+		PartOfNGInterface: []NGInterface{
+			{RanUENgapID: 999, AmfUENgapID: 999},
+		},
+	})
+	if err != nil {
+		t.Fatalf("failed to build NGReset: %v", err)
+	}
+
+	assertNoPanic(t, "HandleNGReset(PartOfNGInterface with unknown UE)", func() {
+		ngap.HandleNGReset(context.Background(), ran, msg.InitiatingMessage.Value.NGReset)
+	})
+
+	if len(fakeNGAPSender.SentNGResetAcknowledges) != 1 {
+		t.Fatalf("expected 1 NGResetAcknowledge, got %d", len(fakeNGAPSender.SentNGResetAcknowledges))
+	}
+}

@@ -151,6 +151,7 @@ func HandleUEContextReleaseComplete(ctx context.Context, amf *amfContext.AMF, ra
 				smContext, ok := amfUe.SmContextFindByPDUSessionID(pduSessionID)
 				if !ok {
 					logger.WithTrace(ctx, ranUe.Log).Error("SmContext not found", zap.Uint8("PduSessionID", pduSessionID))
+					continue
 				}
 
 				err := pdusession.DeactivateSmContext(ctx, smContext.Ref)

@@ -6,7 +6,10 @@ import (
 	"context"
 	"testing"
 
+	amfContext "github.com/ellanetworks/core/internal/amf/context"
 	"github.com/ellanetworks/core/internal/amf/ngap"
+	"github.com/ellanetworks/core/internal/amf/sctp"
+	"github.com/ellanetworks/core/internal/logger"
 	"github.com/free5gc/ngap/ngapType"
 )
 
@@ -19,3 +22,75 @@ func TestHandleUEContextReleaseComplete_EmptyIEs(t *testing.T) {
 		ngap.HandleUEContextReleaseComplete(context.Background(), amf, ran, msg)
 	})
 }
+
+// TestHandleUEContextReleaseComplete_SmContextNotFound verifies that a
+// UEContextReleaseComplete referencing a PDU session ID that has no SmContext
+// does NOT panic. Reproduces a nil pointer dereference on smContext.Ref when
+// SmContextFindByPDUSessionID returns (nil, false) and the handler is missing
+// a continue statement.
+func TestHandleUEContextReleaseComplete_SmContextNotFound(t *testing.T) {
+	ran := newTestRadio()
+	amf := newTestAMF()
+
+	// Create a UE in Registered state with an empty SmContextList.
+	amfUe := amfContext.NewAmfUe()
+	amfUe.SetState(amfContext.Registered)
+	amfUe.Log = logger.AmfLog
+
+	ranUe := &amfContext.RanUe{
+		RanUeNgapID: 1,
+		AmfUeNgapID: 100,
+		Radio:       ran,
+		Log:         logger.AmfLog,
+		AmfUe:       amfUe,
+	}
+	amfUe.RanUe = ranUe
+	ran.RanUEs[1] = ranUe
+
+	// Register the radio with the AMF so FindRanUeByAmfUeNgapID can find it.
+	amf.Radios = map[*sctp.SCTPConn]*amfContext.Radio{nil: ran}
+
+	msg := &ngapType.UEContextReleaseComplete{}
+
+	// AMFUENGAPID — mandatory, must match the ranUe.
+	msg.ProtocolIEs.List = append(msg.ProtocolIEs.List, ngapType.UEContextReleaseCompleteIEs{
+		Id:          ngapType.ProtocolIEID{Value: ngapType.ProtocolIEIDAMFUENGAPID},
+		Criticality: ngapType.Criticality{Value: ngapType.CriticalityPresentIgnore},
+		Value: ngapType.UEContextReleaseCompleteIEsValue{
+			Present:     ngapType.UEContextReleaseCompleteIEsPresentAMFUENGAPID,
+			AMFUENGAPID: &ngapType.AMFUENGAPID{Value: 100},
+		},
+	})
+
+	// RANUENGAPID — mandatory.
+	msg.ProtocolIEs.List = append(msg.ProtocolIEs.List, ngapType.UEContextReleaseCompleteIEs{
+		Id:          ngapType.ProtocolIEID{Value: ngapType.ProtocolIEIDRANUENGAPID},
+		Criticality: ngapType.Criticality{Value: ngapType.CriticalityPresentIgnore},
+		Value: ngapType.UEContextReleaseCompleteIEsValue{
+			Present:     ngapType.UEContextReleaseCompleteIEsPresentRANUENGAPID,
+			RANUENGAPID: &ngapType.RANUENGAPID{Value: 1},
+		},
+	})
+
+	// PDUSessionResourceListCxtRelCpl with a session ID that does NOT exist
+	// in the UE's SmContextList. This triggers SmContextFindByPDUSessionID
+	// returning (nil, false).
+	msg.ProtocolIEs.List = append(msg.ProtocolIEs.List, ngapType.UEContextReleaseCompleteIEs{
+		Id:          ngapType.ProtocolIEID{Value: ngapType.ProtocolIEIDPDUSessionResourceListCxtRelCpl},
+		Criticality: ngapType.Criticality{Value: ngapType.CriticalityPresentIgnore},
+		Value: ngapType.UEContextReleaseCompleteIEsValue{
+			Present: ngapType.UEContextReleaseCompleteIEsPresentPDUSessionResourceListCxtRelCpl,
+			PDUSessionResourceListCxtRelCpl: &ngapType.PDUSessionResourceListCxtRelCpl{
+				List: []ngapType.PDUSessionResourceItemCxtRelCpl{
+					{
+						PDUSessionID: ngapType.PDUSessionID{Value: 5}, // no SmContext for session 5
+					},
+				},
+			},
+		},
+	})
+
+	assertNoPanic(t, "HandleUEContextReleaseComplete(SmContext not found)", func() {
+		ngap.HandleUEContextReleaseComplete(context.Background(), amf, ran, msg)
+	})
+}