fixeria submitted this change.
oml: validate Intave Parameter range in SET BTS ATTR
3GPP TS 52.021 §9.4.24 defines valid range for the Intave Parameter
as 1..31, matching the fixed size of the per-lchan interference sample
buffer (interf_meas_dbm[31] in lchan.h). Previously any uint8_t value
was accepted without validation, meaning a buggy BSC could send
intave=0 (silently disabling interference reporting) or intave>31
(causing a buffer overflow in gsm_lchan_interf_meas_push()).
Let's guard against that by NACKing the SET BTS ATTR message with
cause=NM_NACK_PARAM_RANGE if the value is outside the valid range.
Change-Id: Id4d3353d4397aaa2517091b020d38ee15e084e2c
AI-Assisted: yes (Claude)
---
M src/common/oml.c
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/src/common/oml.c b/src/common/oml.c
index 35b8664..ce5f7f9 100644
--- a/src/common/oml.c
+++ b/src/common/oml.c
@@ -955,9 +955,16 @@
bts->interference.boundary[i] = -1 * boundary;
}
}
- /* 9.4.24 Intave Parameter */
- if (TLVP_PRES_LEN(&tp, NM_ATT_INTAVE_PARAM, 1))
- bts->interference.intave = *TLVP_VAL(&tp, NM_ATT_INTAVE_PARAM);
+ /* 9.4.24 Intave Parameter (3GPP TS 52.021 §9.4.24: range 1..31) */
+ if (TLVP_PRES_LEN(&tp, NM_ATT_INTAVE_PARAM, 1)) {
+ uint8_t intave = *TLVP_VAL(&tp, NM_ATT_INTAVE_PARAM);
+ if (intave < 1 || intave > 31) {
+ LOGPFOH(DOML, LOGL_ERROR, foh,
+ "Intave Parameter %u out of range (1..31)\n", intave);
+ return oml_fom_ack_nack(msg, NM_NACK_PARAM_RANGE);
+ }
+ bts->interference.intave = intave;
+ }
/* 9.4.14 Connection Failure Criterion */
if (TLVP_PRES_LEN(&tp, NM_ATT_CONN_FAIL_CRIT, 1)) {
To view, visit change 42908. To unsubscribe, or for help writing mail filters, visit settings.