binder: fix out-of-bounds read in getServingNode()

servingNode_ is a std::vector, so indexing it past the end is undefined
behavior -- it does not "extend the vector with zeroes" as the comment
claimed. registerServingNode()/unregisterServingNode() both guard the
size already; getServingNode() did not.

Return NODEID_NONE for a UE that has no slot yet, which is what the
zero the old code happened to read would have meant anyway.

computeD2DCapability() indexed the vector directly with the same
problem; route it through getServingNode() instead.

Latent in the shipped configurations, since Registration registers
every UE at INITSTAGE_SIMU5G_NODE_RELATIONSHIPS, before any lookup.

Author: avarga

src/simu5g/common/binder/Binder.cc

@@ -240,7 +240,8 @@ void Binder::unregisterServingNode(MacNodeId enbId, MacNodeId ueId)
 MacNodeId Binder::getServingNode(MacNodeId ueId)
 {
     ASSERT(getNodeTypeById(ueId) == UE);
-    return servingNode_[num(ueId)]; // overindexing extends vector with zeroes, which is fine
+    // A UE that has not registered a serving node yet has no slot in the vector.
+    return num(ueId) < servingNode_.size() ? servingNode_[num(ueId)] : NODEID_NONE;
 }
 
 void Binder::registerMasterNode(MacNodeId masterId, MacNodeId slaveId)
@@ -631,7 +632,7 @@ LteD2DMode Binder::computeD2DCapability(MacNodeId src, MacNodeId dst)
     LteMacBase *dstMac = getMacFromMacNodeId(dst);
     if (dstMac->isD2DCapable()) {
         // set the initial mode
-        if (servingNode_[num(src)] == servingNode_[num(dst)]) {
+        if (getServingNode(src) == getServingNode(dst)) {
             // if served by the same cell, then the mode is selected according to the corresponding parameter
             LteMacBase *srcMac = getMacFromMacNodeId(src);
             inet::NetworkInterface *srcNic = getContainingNicModule(srcMac);