Skip to content

Non-Canonical Problem in ASN.1 Extension Packing #1402

@zhouxt1

Description

@zhouxt1

Hi,

I found the following potential issue in the ASN.1 code.
When we encode sequence extensions, if all the extensions are absent, we should not encode the extension bit at the begining of the sequence. This is implied in X.691 19.1.

We take this example in 5G RRC layer,

FailureReportSCG-EUTRA ::=                       SEQUENCE {
    failureType                                           ENUMERATED {
                                                                       t313-Expiry, randomAccessProblem,rlc-MaxNumRetx,
                                                                          scg-ChangeFailure, spare4,
                                                                          spare3, spare2, spare1},
    measResultFreqListMRDC                             MeasResultFreqListFailMRDC                                                   OPTIONAL,
    measResultSCG-FailureMRDC                         OCTET STRING                                                         OPTIONAL,
    ...,
    [[
    locationInfo-r16                                    LocationInfo-r16                                                         OPTIONAL
    ]]
}

This is the pack code:

SRSASN_CODE fail_report_scg_eutra_s::pack(bit_ref& bref) const
{
  bref.pack(ext, 1);
  HANDLE_CODE(bref.pack(meas_result_freq_list_mrdc.size() > 0, 1));
  HANDLE_CODE(bref.pack(meas_result_scg_fail_mrdc.size() > 0, 1));

  HANDLE_CODE(fail_type.pack(bref));
  if (meas_result_freq_list_mrdc.size() > 0) {
    HANDLE_CODE(pack_dyn_seq_of(bref, meas_result_freq_list_mrdc, 1, 8));
  }
  if (meas_result_scg_fail_mrdc.size() > 0) {
    HANDLE_CODE(meas_result_scg_fail_mrdc.pack(bref));
  }

  if (ext) {
    ext_groups_packer_guard group_flags;
    group_flags[0] |= location_info_r16.is_present();
    group_flags.pack(bref);

    if (group_flags[0]) {
      varlength_field_pack_guard varlen_scope(bref, false);

      HANDLE_CODE(bref.pack(location_info_r16.is_present(), 1));
      if (location_info_r16.is_present()) {
        HANDLE_CODE(location_info_r16->pack(bref));
      }
    }
  }
  return SRSASN_SUCCESS;
}

A possible scenario is when the first extension group is absent, but ext is somehow set to True.
In this scenario, before the extension bit is encoded, there is no extra check to see whether it is actually True or not. So it is encoded to 1, indicating that some extension exists.
So the encoding becomes [ Ext: 1 | Bitmap : 00 | failureType : 001 | Num Of Ext: 0000000 | Bitmap : 0 ]
Instead, the correct encoding should be [ 0 | 00 | 001 ].

The ASN.1 compiler is not open source, so could you take a look at this issue? Thank you.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions