fixeria submitted this change.

View Change

Approvals: Jenkins Builder: Verified osmith: Looks good to me, but someone else must approve pespin: Looks good to me, but someone else must approve laforge: Looks good to me, approved
oml: validate Intave Parameter range in SET BTS ATTR

3GPP TS 52.021 §9.4.24 defines valid range for the Intave Parameter
as 1..31, matching the fixed size of the per-lchan interference sample
buffer (interf_meas_dbm[31] in lchan.h). Previously any uint8_t value
was accepted without validation, meaning a buggy BSC could send
intave=0 (silently disabling interference reporting) or intave>31
(causing a buffer overflow in gsm_lchan_interf_meas_push()).

Let's guard against that by NACKing the SET BTS ATTR message with
cause=NM_NACK_PARAM_RANGE if the value is outside the valid range.

Change-Id: Id4d3353d4397aaa2517091b020d38ee15e084e2c
AI-Assisted: yes (Claude)
---
M src/common/oml.c
1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/common/oml.c b/src/common/oml.c
index 35b8664..ce5f7f9 100644
--- a/src/common/oml.c
+++ b/src/common/oml.c
@@ -955,9 +955,16 @@
bts->interference.boundary[i] = -1 * boundary;
}
}
- /* 9.4.24 Intave Parameter */
- if (TLVP_PRES_LEN(&tp, NM_ATT_INTAVE_PARAM, 1))
- bts->interference.intave = *TLVP_VAL(&tp, NM_ATT_INTAVE_PARAM);
+ /* 9.4.24 Intave Parameter (3GPP TS 52.021 §9.4.24: range 1..31) */
+ if (TLVP_PRES_LEN(&tp, NM_ATT_INTAVE_PARAM, 1)) {
+ uint8_t intave = *TLVP_VAL(&tp, NM_ATT_INTAVE_PARAM);
+ if (intave < 1 || intave > 31) {
+ LOGPFOH(DOML, LOGL_ERROR, foh,
+ "Intave Parameter %u out of range (1..31)\n", intave);
+ return oml_fom_ack_nack(msg, NM_NACK_PARAM_RANGE);
+ }
+ bts->interference.intave = intave;
+ }

/* 9.4.14 Connection Failure Criterion */
if (TLVP_PRES_LEN(&tp, NM_ATT_CONN_FAIL_CRIT, 1)) {

To view, visit change 42908. To unsubscribe, or for help writing mail filters, visit settings.

Gerrit-MessageType: merged
Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-Change-Id: Id4d3353d4397aaa2517091b020d38ee15e084e2c
Gerrit-Change-Number: 42908
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy@sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy@sysmocom.de>
Gerrit-Reviewer: laforge <laforge@osmocom.org>
Gerrit-Reviewer: osmith <osmith@sysmocom.de>
Gerrit-Reviewer: pespin <pespin@sysmocom.de>