fixeria has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bts/+/42908?usp=email )

Change subject: oml: validate Intave Parameter range in SET BTS ATTR ......................................................................

oml: validate Intave Parameter range in SET BTS ATTR

3GPP TS 52.021 §9.4.24 defines valid range for the Intave Parameter as 1..31, matching the fixed size of the per-lchan interference sample buffer (interf_meas_dbm[31] in lchan.h). Previously any uint8_t value was accepted without validation, meaning a buggy BSC could send intave=0 (silently disabling interference reporting) or intave>31 (causing a buffer overflow in gsm_lchan_interf_meas_push()).

Let's guard against that by NACKing the SET BTS ATTR message with cause=NM_NACK_PARAM_RANGE if the value is outside the valid range.

Change-Id: Id4d3353d4397aaa2517091b020d38ee15e084e2c AI-Assisted: yes (Claude) --- M src/common/oml.c 1 file changed, 10 insertions(+), 3 deletions(-)

Approvals: Jenkins Builder: Verified osmith: Looks good to me, but someone else must approve pespin: Looks good to me, but someone else must approve laforge: Looks good to me, approved

diff --git a/src/common/oml.c b/src/common/oml.c index 35b8664..ce5f7f9 100644 --- a/src/common/oml.c +++ b/src/common/oml.c @@ -955,9 +955,16 @@ bts->interference.boundary[i] = -1 * boundary; } } - /* 9.4.24 Intave Parameter */ - if (TLVP_PRES_LEN(&tp, NM_ATT_INTAVE_PARAM, 1)) - bts->interference.intave = *TLVP_VAL(&tp, NM_ATT_INTAVE_PARAM); + /* 9.4.24 Intave Parameter (3GPP TS 52.021 §9.4.24: range 1..31) */ + if (TLVP_PRES_LEN(&tp, NM_ATT_INTAVE_PARAM, 1)) { + uint8_t intave = *TLVP_VAL(&tp, NM_ATT_INTAVE_PARAM); + if (intave < 1 || intave > 31) { + LOGPFOH(DOML, LOGL_ERROR, foh, + "Intave Parameter %u out of range (1..31)\n", intave); + return oml_fom_ack_nack(msg, NM_NACK_PARAM_RANGE); + } + bts->interference.intave = intave; + }

/* 9.4.14 Connection Failure Criterion */ if (TLVP_PRES_LEN(&tp, NM_ATT_CONN_FAIL_CRIT, 1)) {