yigid/openairinterface5g
1
0
Fork 0
mirror of https://gitlab.eurecom.fr/oai/openairinterface5g.git synced 2026-07-13 04:30:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fic (NGAP): double allocation and ASN free in PDU Session Modify Response

Browse Source 
Remove redundant allocation and duplicate add for AMF_UE_NGAP_ID (asn1cSequenceAdd
already allocates), fixing encoding failure and leak. Fix ASN_STRUCT_FREE_CONTENTS_ONLY
in the unsuccessful-transfer path to free the correct struct.

Changes:
- In ngap_gNB_pdusession_modify_resp(), for AMF_UE_NGAP_ID IE: remove redundant
  calloc() and duplicate asn1cSeqAdd() after asn1cSequenceAdd (avoids uninitialized
  list element, encoding assertion, and leak).
- In PDU Session Resource Modify Unsuccessful Transfer handling: pass
  &pdusessionTransfer to ASN_STRUCT_FREE_CONTENTS_ONLY instead of the unused
  NULL pointer pdusessionTransfer_p;

Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
This commit is contained in:
Guido Casati
2026-02-18 17:03:16 +01:00
parent 835c80b39d
commit 77aff40af7
1 changed files with 5 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
openair3/NGAP/ngap_gNB_pdu_session_management.c
View File

@@ -194,12 +194,10 @@ int ngap_gNB_pdusession_modify_resp(instance_t instance, ngap_pdusession_modify_
/* mandatory */
{
asn1cSequenceAdd(out->protocolIEs.list, NGAP_PDUSessionResourceModifyResponseIEs_t, ie);
ie = (NGAP_PDUSessionResourceModifyResponseIEs_t *)calloc(1, sizeof(NGAP_PDUSessionResourceModifyResponseIEs_t));
ie->id = NGAP_ProtocolIE_ID_id_AMF_UE_NGAP_ID;
ie->criticality = NGAP_Criticality_ignore;
ie->value.present = NGAP_PDUSessionResourceModifyResponseIEs__value_PR_AMF_UE_NGAP_ID;
asn_uint642INTEGER(&ie->value.choice.AMF_UE_NGAP_ID, pdusession_modify_resp_p->amf_ue_ngap_id);
asn1cSeqAdd(&out->protocolIEs.list, ie);
}
/* mandatory */
{
@@ -260,16 +258,14 @@ int ngap_gNB_pdusession_modify_resp(instance_t instance, ngap_pdusession_modify_
// NGAP cause
encode_ngap_cause(&pdusessionTransfer.cause, &pdusession_modify_resp_p->pdusessions_failed[i].cause);
asn_encode_to_new_buffer_result_t res = {0};
NGAP_PDUSessionResourceModifyUnsuccessfulTransfer_t *pdusessionTransfer_p = NULL;
res = asn_encode_to_new_buffer(NULL,
ATS_ALIGNED_CANONICAL_PER,
&asn_DEF_NGAP_PDUSessionResourceModifyUnsuccessfulTransfer,
&pdusessionTransfer);
asn_encode_to_new_buffer_result_t res = asn_encode_to_new_buffer(NULL,
ATS_ALIGNED_CANONICAL_PER,
&asn_DEF_NGAP_PDUSessionResourceModifyUnsuccessfulTransfer,
&pdusessionTransfer);
item->pDUSessionResourceModifyUnsuccessfulTransfer.buf = res.buffer;
item->pDUSessionResourceModifyUnsuccessfulTransfer.size = res.result.encoded;
ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_NGAP_PDUSessionResourceModifyUnsuccessfulTransfer, pdusessionTransfer_p);
ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_NGAP_PDUSessionResourceModifyUnsuccessfulTransfer, &pdusessionTransfer);
NGAP_INFO("pdusession_modify_resp: failed pdusession ID %ld\n", item->pDUSessionID);
}