From 7faa5da209d0ef48fe593603c217615f09fb61fb Mon Sep 17 00:00:00 2001 From: Pau Espin Pedrol Date: Sat, 21 Mar 2020 00:13:33 +0100 Subject: rlcmac: Fix bug receiving RA cap It seems the assumptions regarding maximum number of RA capabilitites in one message were wrong. Doing some rough calculations, each RA capabilitiy value (without extensions) can take around 20ish bits, which means for a message containing up to 52 bytes that quite a lot of different values could be theoretically fed in. Let's be safe and increase the array size to be able to handle all different access technologies listed in See TS 24.008 table 10.5.146 following restrictions: * "The MS Radio Access capability is a type 4 information element, with a maximum length of 52 octets." * "Among the three Access Type Technologies GSM 900-P, GSM 900-E and GSM 900-R only one shall be present." * "the mobile station should provide the relevant radio access capability for either GSM 1800 band OR GSM 1900 band, not both". Wireshark requires similar fix (it's not important though because it currently uses another ad-hoc decoder for RAcap). Related: OS#4463 Change-Id: I5334eaacfbc238fae8bea50c9e9667c2117f81ff --- src/gsm_rlcmac.h | 21 ++++++--------------- 1 file changed, 6 insertions(+), 15 deletions(-) (limited to 'src') diff --git a/src/gsm_rlcmac.h b/src/gsm_rlcmac.h index 10bb6afb..9e38966a 100644 --- a/src/gsm_rlcmac.h +++ b/src/gsm_rlcmac.h @@ -1224,10 +1224,6 @@ typedef struct } Content_t; -#define ABSOLUTE_MAX_BANDS 2 /* New fields for R4 extend the length of the capabilities message so we can only send 2 */ - -#define MAX_ACCESS_TECHNOLOGIES_COUNT 16 /* No more than 16 instances */ - typedef enum {/* See TS 24.008 table 10.5.146 */ AccTech_GSMP = 0x0, @@ -1246,14 +1242,9 @@ typedef enum AccTech_GSMT810 = 0xd, AccTech_GSMOther = 0xf } AccessTechnology_t; - -#if 0 -typedef struct -{ - guint8 CountAccessTechnologies; - AccessTechnology_t AccessTechnologies[MAX_ACCESS_TECHNOLOGIES_COUNT]; -} AccessTechnologiesRequest_t; -#endif +/* Maximum entries in one message, Enum above, appying restrictions from section + 12.30 "MS Radio Access Capability 2": */ +#define MAX_ACCESS_TECHNOLOGIES_COUNT 11 typedef struct { @@ -1266,8 +1257,8 @@ typedef struct { guint8 Count_additional_access_technologies; /* The value 0xf cannot be set for the first ATT, therefore we can only have - ABSOLUTE_MAX_BANDS-1 additional access technologies. */ - Additional_access_technologies_struct_t Additional_access_technologies[ABSOLUTE_MAX_BANDS-1]; + MAX_ACCESS_TECHNOLOGIES_COUNT-1 additional access technologies. */ + Additional_access_technologies_struct_t Additional_access_technologies[MAX_ACCESS_TECHNOLOGIES_COUNT-1]; } Additional_access_technologies_t; typedef struct @@ -1285,7 +1276,7 @@ typedef struct typedef struct { guint8 Count_MS_RA_capability_value; /* Recursive */ - MS_RA_capability_value_t MS_RA_capability_value[ABSOLUTE_MAX_BANDS]; + MS_RA_capability_value_t MS_RA_capability_value[MAX_ACCESS_TECHNOLOGIES_COUNT]; } MS_Radio_Access_capability_t; -- cgit v1.2.3