Malformed RRCInactiveTransitionReport causes AMF to crash

[shovon0203]

If a malformed RRCInactiveTransitionReport is sent to AMF, it crashes.

AMF Version: v2.0.2

Reproduction Step:

Send this following RRCInactiveTransitionReport NGAP message
00 25 40 2E 80 00 03 00 0A 80 06 80 DF 53 BA 38 2D 00 00 00 05 C0 FA D5 D2 67 00 5C 40 01 40 00 79 00 0F 30 59 73 F1 FA 55 AB 04 79 65 CF C4 00 00 07

AMF Log:

2026-02-10T00:59:31.602Z	INFO	ngap/dispatcher.go:132	Create a new NG connection for: 127.0.0.1:46404	{"component": "AMF", "category": "NGAP"}
2026-02-10T00:59:31.602Z	INFO	ngap/handler.go:2852	handle RRC Inactive Transition Report	{"component": "AMF", "category": "NGAP", "ran_addr": "127.0.0.1:46404"}
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x137a927]
goroutine 620 gp=0xc000783c00 m=6 mp=0xc000480008 [running]:
panic({0x1624140?, 0x26d9d20?})
	/usr/local/go/src/runtime/panic.go:802 +0x168 fp=0xc0006a1a40 sp=0xc0006a1990 pc=0x481128
runtime.panicmem(...)
	/usr/local/go/src/runtime/panic.go:262
runtime.sigpanic()
	/usr/local/go/src/runtime/signal_unix.go:925 +0x359 fp=0xc0006a1aa0 sp=0xc0006a1a40 pc=0x483ab9
github.com/omec-project/amf/ngap.HandleRRCInactiveTransitionReport(0xc00027fae0, 0x0?)
	/go/src/amf/ngap/handler.go:2888 +0x687 fp=0xc0006a1ca0 sp=0xc0006a1aa0 pc=0x137a927
github.com/omec-project/amf/ngap.DispatchNgapMsg({0x1b369a0, 0x2734720}, 0xc00027fae0, 0xc000e101a0, 0x0)
	/go/src/amf/ngap/dispatcher.go:259 +0xb7f fp=0xc0006a1fa8 sp=0xc0006a1ca0 pc=0x136419f
github.com/omec-project/amf/ngap.Dispatch.gowrap1()
	/go/src/amf/ngap/dispatcher.go:169 +0x2e fp=0xc0006a1fe0 sp=0xc0006a1fa8 pc=0x136356e
runtime.goexit({})
	/usr/local/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc0006a1fe8 sp=0xc0006a1fe0 pc=0x489ca1
created by github.com/omec-project/amf/ngap.Dispatch in goroutine 612
	/go/src/amf/ngap/dispatcher.go:169 +0x5c6

Advisory:
This bug has been fixed in the latest release
https://hub.docker.com/layers/omecproject/5gc-amf/rel-2.2.1/images/sha256-8a4c33cdda866094f1989bdeff6d8642fce8de8435f89defd66831c97715f5aa

[gab-arrobo]

Fixed in #666