Skip to content

nrUE Seg Fault caused by measurement object number

In ASN.1 definition, the maximum number of measuremnet object

maxNrofObjectId                         INTEGER ::= 64      -- Maximum number of measurement objects

But, in openair2/RRC/NR_UE/rrc_defs.h,

#define MAX_MEAS_OBJ 7

used in rrcPerNB_t.

However, in openair2/RRC/NR_UE/rrc_UE.c, there is no such size check on the number, since the ASN1c parser will accept all messages smaller than 64. And this is causing seg faults. For example, in handle_measobj_addmod function,

    if (rrc->MeasObj[id]) {
      update_nr_measobj(measObj->measObject.choice.measObjectNR, rrc->MeasObj[id]->measObject.choice.measObjectNR);
    }

if provided an RRC DL-DCCH-Message with measure object id set to a number n larger than 7 to the UE, and the corresponding memory is not empty in rrc->MeasObj[n], this would cause a segmentation fault.

Similar things could happen in handle_measobj_remove.

The testing is done using 2025.w13 branch.