nrUE Seg Fault caused by measurement object number
In ASN.1 definition, the maximum number of measuremnet object
maxNrofObjectId INTEGER ::= 64 -- Maximum number of measurement objects
But, in openair2/RRC/NR_UE/rrc_defs.h
,
#define MAX_MEAS_OBJ 7
used in rrcPerNB_t
.
However, in openair2/RRC/NR_UE/rrc_UE.c
, there is no such size check on the number, since the ASN1c parser will accept all messages smaller than 64. And this is causing seg faults. For example, in handle_measobj_addmod
function,
if (rrc->MeasObj[id]) {
update_nr_measobj(measObj->measObject.choice.measObjectNR, rrc->MeasObj[id]->measObject.choice.measObjectNR);
}
if provided an RRC DL-DCCH-Message with measure object id set to a number n
larger than 7 to the UE, and the corresponding memory is not empty in rrc->MeasObj[n]
, this would cause a segmentation fault.
Similar things could happen in handle_measobj_remove
.
The testing is done using 2025.w13
branch.