AMF crashes on handling RegistrationRequest

[shovon0203]

AMF crashes if a registration request with invalid SUCI format is sent. It crashes on converting it to valid MobileIdentity.

AMF Version: v2.0.2

Reproduction Step:

Packet 1: Send NGSetupRequest
00 15 00 33 00 00 05 00 1B 00 08 00 00 F1 10 00 00 06 6C 00 52 40 05 01 00 52 41 4E 00 66 00 0D 00 00 00 00 07 00 00 F1 10 00 00 00 08 00 15 40 01 20 00 93 40 01 00

Packet 2: Send RegistrationRequest (InitialUEMessage)
00 0F 40 63 00 00 05 00 55 00 02 00 01 00 26 00 39 38 7E 00 41 79 00 08 01 02 F8 39 00 00 00 00 C0 C0 B0 B0 80 80 90 90 A0 A0 C0 C0 B0 B0 80 80 90 90 A0 A0 C0 C0 B0 B0 80 80 90 90 A0 A0 C0 C0 B0 B0 80 80 90 90 A0 A0 C0 C0 00 79 00 0F 40 00 F1 10 00 00 00 00 00 00 F1 10 00 00 07 00 5A 40 01 18 00 70 40 01 00

AMF Log:

2026-02-09T20:45:05.970Z	INFO	context/transaction.go:24	updated ngaphandler	{"component": "AMF", "category": "GMM", "amf_ue_ngap_id": "AMF_UE_NGAP_ID:11818983"}
2026-02-09T20:45:05.970Z	INFO	ngap/dispatcher.go:161	gnbid match	{"component": "AMF", "category": "GMM", "amf_ue_ngap_id": "AMF_UE_NGAP_ID:11818983"}
2026-02-09T20:45:05.970Z	INFO	ngap/handler.go:1456	handle Initial UE Message	{"component": "AMF", "category": "NGAP", "ran_addr": "127.0.0.1:55701"}
2026-02-09T20:45:05.971Z	INFO	fsm/fsm.go:100	handle event[Gmm Message], transition from [Deregistered] to [Deregistered]	{"component": "LIB", "category": "FSM"}
2026-02-09T20:45:05.971Z	INFO	gmm/handler.go:486	handle Registration Request	{"component": "AMF", "category": "GMM", "amf_ue_ngap_id": "AMF_UE_NGAP_ID:11818983"}
panic: runtime error: index out of range [-1]
goroutine 942088 gp=0xc000bab180 m=20 mp=0xc000465008 [running]:
panic({0x1788d40?, 0xc00093cdc8?})
	/usr/local/go/src/runtime/panic.go:802 +0x168 fp=0xc000802840 sp=0xc000802790 pc=0x481128
runtime.goPanicIndex(0xffffffffffffffff, 0x0)
	/usr/local/go/src/runtime/panic.go:115 +0x74 fp=0xc000802880 sp=0xc000802840 pc=0x445b94
github.com/omec-project/nas/nasConvert.SuciToString({0xc000802ce8, 0x8, 0x8})
	/go/src/amf/vendor/github.com/omec-project/nas/nasConvert/MobileIdentity5GS.go:80 +0x89c fp=0xc000802ad0 sp=0xc000802880 pc=0x131e75c
github.com/omec-project/amf/gmm.HandleRegistrationRequest({0x1b36a58, 0xc00034e240}, 0xc0007ea008, {0x186baaa, 0xb}, 0x0?, 0xc000d281a0)
	/go/src/amf/gmm/handler.go:570 +0x7bb fp=0xc0008030d0 sp=0xc000802ad0 pc=0x13486bb
github.com/omec-project/amf/gmm.DeRegistered({0x1b36a58, 0xc00034e240}, 0xc0003430e0, {0x186be30?, 0x0?}, 0xc00034e690)
	/go/src/amf/gmm/sm.go:40 +0x691 fp=0xc000803250 sp=0xc0008030d0 pc=0x1359a71
github.com/omec-project/util/fsm.(*FSM).SendEvent(0xc000528020, {0x1b36a58, 0xc00034e240}, 0xc0003430e0, {0x186be30, 0xb}, 0xc00034e690)
	/go/src/amf/vendor/github.com/omec-project/util/fsm/fsm.go:103 +0x254 fp=0xc000803388 sp=0xc000803250 pc=0x10b0934
github.com/omec-project/amf/nas.Dispatch({0x1b36a58, 0xc00034e240}, 0xc0007ea008, {0x186baaa, 0xb}, 0xf, 0xc0010444a0)
	/go/src/amf/nas/dispatch.go:50 +0x95d fp=0xc000803578 sp=0xc000803388 pc=0x136101d
github.com/omec-project/amf/nas.HandleNAS({0x1b36a58, 0xc00034e240}, 0xc0008a4a00, 0xf, {0xc00059e780?, 0x18a86db?, 0x30?})
	/go/src/amf/nas/handler.go:105 +0x18c fp=0xc000803708 sp=0xc000803578 pc=0x13612cc
github.com/omec-project/amf/ngap.HandleInitialUEMessage({0x1b36a58, 0xc00034e240}, 0xc000214640, 0xc001088c80, 0x0)
	/go/src/amf/ngap/handler.go:1634 +0x15e5 fp=0xc000803b50 sp=0xc000803708 pc=0x1370b85
github.com/omec-project/amf/ngap.DispatchNgapMsg({0x1b369a0, 0x2734720}, 0xc000214640, 0xc001088c80, 0x0)
	/go/src/amf/ngap/dispatcher.go:235 +0xa37 fp=0xc000803e58 sp=0xc000803b50 pc=0x1364057
github.com/omec-project/amf/ngap.NgapMsgHandler(0xc000cf4f68?, {0x0?, 0xc001088c80?, 0xc000214640?})
	/go/src/amf/ngap/dispatcher.go:174 +0x3c fp=0xc000803e90 sp=0xc000803e58 pc=0x13635dc
github.com/omec-project/amf/context.(*EventChannel).Start(0xc00017f200, {0x1b369a0, 0x2734720})
	/go/src/amf/context/transaction.go:51 +0x306 fp=0xc000803fb8 sp=0xc000803e90 pc=0x125bf86
github.com/omec-project/amf/context.(*AmfUe).SetEventChannel.gowrap2()
	/go/src/amf/context/amf_ue.go:1042 +0x28 fp=0xc000803fe0 sp=0xc000803fb8 pc=0x124ef08
runtime.goexit({})
	/usr/local/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc000803fe8 sp=0xc000803fe0 pc=0x489ca1
created by github.com/omec-project/amf/context.(*AmfUe).SetEventChannel in goroutine 941216
	/go/src/amf/context/amf_ue.go:1042 +0x239

[gab-arrobo]

Fixed in #666

[wangling952013]

Checking for CVE-2026-9300 related fix