fixeria has submitted this change. (
https://gerrit.osmocom.org/c/osmo-bts/+/42908?usp=email )
Change subject: oml: validate Intave Parameter range in SET BTS ATTR
......................................................................
oml: validate Intave Parameter range in SET BTS ATTR
3GPP TS 52.021 §9.4.24 defines valid range for the Intave Parameter
as 1..31, matching the fixed size of the per-lchan interference sample
buffer (interf_meas_dbm[31] in lchan.h). Previously any uint8_t value
was accepted without validation, meaning a buggy BSC could send
intave=0 (silently disabling interference reporting) or intave>31
(causing a buffer overflow in gsm_lchan_interf_meas_push()).
Let's guard against that by NACKing the SET BTS ATTR message with
cause=NM_NACK_PARAM_RANGE if the value is outside the valid range.
Change-Id: Id4d3353d4397aaa2517091b020d38ee15e084e2c
AI-Assisted: yes (Claude)
---
M src/common/oml.c
1 file changed, 10 insertions(+), 3 deletions(-)
Approvals:
Jenkins Builder: Verified
osmith: Looks good to me, but someone else must approve
pespin: Looks good to me, but someone else must approve
laforge: Looks good to me, approved
diff --git a/src/common/oml.c b/src/common/oml.c
index 35b8664..ce5f7f9 100644
--- a/src/common/oml.c
+++ b/src/common/oml.c
@@ -955,9 +955,16 @@
bts->interference.boundary[i] = -1 * boundary;
}
}
- /* 9.4.24 Intave Parameter */
- if (TLVP_PRES_LEN(&tp, NM_ATT_INTAVE_PARAM, 1))
- bts->interference.intave = *TLVP_VAL(&tp, NM_ATT_INTAVE_PARAM);
+ /* 9.4.24 Intave Parameter (3GPP TS 52.021 §9.4.24: range 1..31) */
+ if (TLVP_PRES_LEN(&tp, NM_ATT_INTAVE_PARAM, 1)) {
+ uint8_t intave = *TLVP_VAL(&tp, NM_ATT_INTAVE_PARAM);
+ if (intave < 1 || intave > 31) {
+ LOGPFOH(DOML, LOGL_ERROR, foh,
+ "Intave Parameter %u out of range (1..31)\n",
intave);
+ return oml_fom_ack_nack(msg, NM_NACK_PARAM_RANGE);
+ }
+ bts->interference.intave = intave;
+ }
/* 9.4.14 Connection Failure Criterion */
if (TLVP_PRES_LEN(&tp, NM_ATT_CONN_FAIL_CRIT, 1)) {
--
To view, visit https://gerrit.osmocom.org/c/osmo-bts/+/42908?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-Change-Id: Id4d3353d4397aaa2517091b020d38ee15e084e2c
Gerrit-Change-Number: 42908
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <[email protected]>
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: osmith <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
