fixeria has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bts/+/42908?usp=email ) Change subject: oml: validate Intave Parameter range in SET BTS ATTR ...................................................................... oml: validate Intave Parameter range in SET BTS ATTR 3GPP TS 52.021 §9.4.24 defines valid range for the Intave Parameter as 1..31, matching the fixed size of the per-lchan interference sample buffer (interf_meas_dbm[31] in lchan.h). Previously any uint8_t value was accepted without validation, meaning a buggy BSC could send intave=0 (silently disabling interference reporting) or intave>31 (causing a buffer overflow in gsm_lchan_interf_meas_push()). Let's guard against that by NACKing the SET BTS ATTR message with cause=NM_NACK_PARAM_RANGE if the value is outside the valid range. Change-Id: Id4d3353d4397aaa2517091b020d38ee15e084e2c AI-Assisted: yes (Claude) --- M src/common/oml.c 1 file changed, 10 insertions(+), 3 deletions(-) Approvals: Jenkins Builder: Verified osmith: Looks good to me, but someone else must approve pespin: Looks good to me, but someone else must approve laforge: Looks good to me, approved diff --git a/src/common/oml.c b/src/common/oml.c index 35b8664..ce5f7f9 100644 --- a/src/common/oml.c +++ b/src/common/oml.c @@ -955,9 +955,16 @@ bts->interference.boundary[i] = -1 * boundary; } } - /* 9.4.24 Intave Parameter */ - if (TLVP_PRES_LEN(&tp, NM_ATT_INTAVE_PARAM, 1)) - bts->interference.intave = *TLVP_VAL(&tp, NM_ATT_INTAVE_PARAM); + /* 9.4.24 Intave Parameter (3GPP TS 52.021 §9.4.24: range 1..31) */ + if (TLVP_PRES_LEN(&tp, NM_ATT_INTAVE_PARAM, 1)) { + uint8_t intave = *TLVP_VAL(&tp, NM_ATT_INTAVE_PARAM); + if (intave < 1 || intave > 31) { + LOGPFOH(DOML, LOGL_ERROR, foh, + "Intave Parameter %u out of range (1..31)\n", intave); + return oml_fom_ack_nack(msg, NM_NACK_PARAM_RANGE); + } + bts->interference.intave = intave; + } /* 9.4.14 Connection Failure Criterion */ if (TLVP_PRES_LEN(&tp, NM_ATT_CONN_FAIL_CRIT, 1)) { -- To view, visit https://gerrit.osmocom.org/c/osmo-bts/+/42908?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-bts Gerrit-Branch: master Gerrit-Change-Id: Id4d3353d4397aaa2517091b020d38ee15e084e2c Gerrit-Change-Number: 42908 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy@sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy@sysmocom.de> Gerrit-Reviewer: laforge <laforge@osmocom.org> Gerrit-Reviewer: osmith <osmith@sysmocom.de> Gerrit-Reviewer: pespin <pespin@sysmocom.de>