The indexes rx_message.ims_data.num_of_media_component and media_component->num_of_sub can overflow.

```
static int pcrf_rx_aar_cb( struct msg **msg, struct avp *avp,
        struct session *sess, void *opaque, enum disp_action *act)
..
        /* Gwt Specific-Action */
        case OGS_DIAM_RX_AVP_CODE_SPECIFIC_ACTION:
            break;
        /* Gwt Media-Component-Description */
        case OGS_DIAM_RX_AVP_CODE_MEDIA_COMPONENT_DESCRIPTION:
            media_component = &rx_message.ims_data.
                    media_component[rx_message.ims_data.num_of_media_component];

            ret = fd_msg_browse(avpch1, MSG_BRW_FIRST_CHILD, &avpch2, NULL);
            ogs_assert(ret == 0);
            while (avpch2) {
                ret = fd_msg_avp_hdr(avpch2, &hdr);
..
                }

                fd_msg_browse(avpch2, MSG_BRW_NEXT, &avpch2, NULL);
            }

            rx_message.ims_data.num_of_media_component++;
            break;
        default:
            ogs_warn("Not supported(%d)", hdr->avp_code);
            break;
        }
..
}
```