From bdaef7956d5b7f0b97dda2605c69438e73736680 Mon Sep 17 00:00:00 2001 From: gabrielC Date: Thu, 11 May 2017 11:48:30 +0200 Subject: [PATCH 1/7] bug fixes from Fujitsu (bugs 18, 19, 20) ---------------------------------------------------------- bug 18 Ttile: Probably he/she wants to copy the contents of arrays, but this coding doesn't copy anything, moreover index overflow occurs. Bug Location: u2e_t[UE_id][eNB_id]->tx_data[3]=tx[eNB_id][3]; u2e_t[UE_id][eNB_id]->rx_data[3]=rx[NB_eNB_INST+UE_id][3]; Note: Detected by CppCheck ---------------------------------------------------------- bug 19 Title: Probably he/she wants to copy the contents of arrays, but this coding doesn't copy anything, moreover index overflow occurs. Bug Location: e2u_t[eNB_id][UE_id]->tx_data[3]=tx[NB_eNB_INST+UE_id][3]; e2u_t[eNB_id][UE_id]->rx_data[3]=rx[eNB_id][3]; Note: Detected by CppCheck ---------------------------------------------------------- bug 20 Title: Probably he/she wants to copy the contents of arrays, but this coding doesn't copy anything, moreover index overflow occurs. Bug Location: tx_data[3]=cthread->tx_data[3]; rx_data[3]=cthread->rx_data[3]; Note: Detected by CppCheck ---------------------------------------------------------- --- targets/SIMU/PROC/Process.c | 15 +++++++++++---- targets/SIMU/PROC/channel_sim_proc.c | 9 +++++++-- 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/targets/SIMU/PROC/Process.c b/targets/SIMU/PROC/Process.c index ee3d6d5c53..9d80c74d99 100644 --- a/targets/SIMU/PROC/Process.c +++ b/targets/SIMU/PROC/Process.c @@ -284,8 +284,12 @@ void Channel_Inst(int node_id,int port,double **s_re[MAX_eNB+MAX_UE],double **s_ u2e_t[UE_id][eNB_id]->next_slot=&next_slot; u2e_t[UE_id][eNB_id]->abstraction_flag=&abstraction_flag; u2e_t[UE_id][eNB_id]->frame_parms=frame_parms; - u2e_t[UE_id][eNB_id]->tx_data[3]=tx[eNB_id][3]; - u2e_t[UE_id][eNB_id]->rx_data[3]=rx[NB_eNB_INST+UE_id][3]; + + for (int i=0;i<3;i++) + { + u2e_t[UE_id][eNB_id]->tx_data[i]=tx[eNB_id][i]; + u2e_t[UE_id][eNB_id]->rx_data[i]=rx[NB_eNB_INST+UE_id][i]; + } if(pthread_cond_init (&downlink_cond[eNB_id][UE_id], NULL)) exit(1); @@ -316,8 +320,11 @@ void Channel_Inst(int node_id,int port,double **s_re[MAX_eNB+MAX_UE],double **s_ e2u_t[eNB_id][UE_id]->next_slot=&next_slot; e2u_t[eNB_id][UE_id]->abstraction_flag=&abstraction_flag; e2u_t[eNB_id][UE_id]->frame_parms=frame_parms; - e2u_t[eNB_id][UE_id]->tx_data[3]=tx[NB_eNB_INST+UE_id][3]; - e2u_t[eNB_id][UE_id]->rx_data[3]=rx[eNB_id][3]; + for (int i=0;i<3;i++) + { + e2u_t[eNB_id][UE_id]->tx_data[i]=tx[NB_eNB_INST+UE_id][i]; + e2u_t[eNB_id][UE_id]->rx_data[i]=rx[eNB_id][i]; + } if(pthread_cond_init (&uplink_cond[UE_id][eNB_id], NULL)) exit(1); diff --git a/targets/SIMU/PROC/channel_sim_proc.c b/targets/SIMU/PROC/channel_sim_proc.c index 0ffdd97ce0..b54fe36460 100644 --- a/targets/SIMU/PROC/channel_sim_proc.c +++ b/targets/SIMU/PROC/channel_sim_proc.c @@ -183,8 +183,13 @@ void do_DL_sig_channel_T(void *param) next_slot=(cthread->next_slot); abstraction_flag=*(cthread->abstraction_flag); thread_id=(cthread->thread_id); - tx_data[3]=cthread->tx_data[3]; - rx_data[3]=cthread->rx_data[3]; + + for (int i=0;i<3;i++) + { + tx_data[i]=cthread->tx_data[i]; + rx_data[i]=cthread->rx_data[i]; + } + s32 att_eNB_id=-1; s32 **txdata,**rxdata; From 98a7a16eadd7c062881c5629dc20b7483c576d51 Mon Sep 17 00:00:00 2001 From: gabrielC Date: Thu, 11 May 2017 11:51:09 +0200 Subject: [PATCH 2/7] bug fixes from Fujitsu (bug 21) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Note: this fix does not solve the issue with how this buffer is used in this function, but I'm not sure this code is used at all (Cédric Roux). ---------------------------------------------------------- bug 21 Ttile: PAYLOAD_MAX=1500, so this coding results in index overflow. Additionally, operator "!=" just compairs something, this coding is meaningless. Bug Location: buffer[PAYLOAD_MAX] != '\0'; Note: Detected by CppCheck ---------------------------------------------------------- --- openair2/UTIL/OTG/otg_rx_socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/UTIL/OTG/otg_rx_socket.c b/openair2/UTIL/OTG/otg_rx_socket.c index 2caeee4f52..98e03532a1 100644 --- a/openair2/UTIL/OTG/otg_rx_socket.c +++ b/openair2/UTIL/OTG/otg_rx_socket.c @@ -98,7 +98,7 @@ void *recv_ip4_tcp(void* csock) LOG_I(OTG,"SOCKET:: TCP-IP4 :: size=%d received=%d, Received buffer: %s \n\n\n", strlen(buffer), sock_rcv, buffer); - buffer[PAYLOAD_MAX] != '\0'; + //buffer[PAYLOAD_MAX] != '\0'; } From 34c6805f7a211894d17146998cbf18259dd99906 Mon Sep 17 00:00:00 2001 From: gabrielC Date: Thu, 11 May 2017 11:54:15 +0200 Subject: [PATCH 3/7] bug fixes from Fujitsu (bug 22) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Note: not sure that the code is correct, to be checked (Cédric Roux). ---------------------------------------------------------- bug 22 Ttile: (subframe!=2)||(subframe!=7) is always TRUE. This coding is really intended? Operator || should be && instead? Bug Location: ((frame_parms->frame_type==TDD)&&(frame_parms->tdd_config==1)&&((subframe!=2)||(subframe!=7)))) { Note: Detected by CppCheck ---------------------------------------------------------- --- openair1/SCHED/phy_procedures_lte_eNb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair1/SCHED/phy_procedures_lte_eNb.c b/openair1/SCHED/phy_procedures_lte_eNb.c index 2f2be51aaa..673583f78c 100644 --- a/openair1/SCHED/phy_procedures_lte_eNb.c +++ b/openair1/SCHED/phy_procedures_lte_eNb.c @@ -2272,7 +2272,7 @@ void pucch_procedures(PHY_VARS_eNB *eNB,eNB_rxtx_proc_t *proc,int UE_id,int harq if ((fp->frame_type==FDD) || (bundling_flag==bundling) || - ((fp->frame_type==TDD)&&(fp->tdd_config==1)&&((subframe!=2)||(subframe!=7)))) { + ((fp->frame_type==TDD)&&(fp->tdd_config==1)&&((subframe!=2)&&(subframe!=7)))) { format = pucch_format1a; } else { format = pucch_format1b; From adb3b25c67c1c76e002dfbb9d07dac7230c8581d Mon Sep 17 00:00:00 2001 From: Cedric Roux Date: Fri, 12 May 2017 11:52:52 +0200 Subject: [PATCH 4/7] bug fixes from Fujitsu (bug 24) ---------------------------------------------------------- bug 24 Ttile: The last line "multicast_group = multicast_group" is hard to understand. The local variable should be different name than the global variable. Bug Location: const char *multicast_group_list[MULTICAST_LINK_NUM_GROUPS] = { "239.0.0.161", "239.0.0.162", "239.0.0.163", "239.0.0.164" }; : : void multicast_link_start(void (*rx_handlerP) (unsigned int, char *), unsigned char multicast_group, char *multicast_ifname) { rx_handler = rx_handlerP; multicast_group = multicast_group; Note: Detected by CppCheck ---------------------------------------------------------- --- openair1/SIMULATION/ETH_TRANSPORT/multicast_link.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openair1/SIMULATION/ETH_TRANSPORT/multicast_link.c b/openair1/SIMULATION/ETH_TRANSPORT/multicast_link.c index 306ec12ad2..d161da6a74 100644 --- a/openair1/SIMULATION/ETH_TRANSPORT/multicast_link.c +++ b/openair1/SIMULATION/ETH_TRANSPORT/multicast_link.c @@ -308,10 +308,10 @@ void* multicast_link_main_loop (void *param) } void multicast_link_start(void (*rx_handlerP) (unsigned int, char *), - unsigned char multicast_group, char *multicast_ifname) + unsigned char _multicast_group, char *multicast_ifname) { rx_handler = rx_handlerP; - multicast_group = multicast_group; + multicast_group = _multicast_group; multicast_if = multicast_ifname; LOG_I(EMU, "[MULTICAST] LINK START on interface=%s for group=%d: handler=%p\n", (multicast_if == NULL) ? "not specified" : multicast_if, multicast_group, From 899d150621e08575f0e5324d5ba5d394f00bc91e Mon Sep 17 00:00:00 2001 From: gabrielC Date: Thu, 11 May 2017 11:57:51 +0200 Subject: [PATCH 5/7] bug fixes from Fujitsu (bug 26) ---------------------------------------------------------- bug 26 Ttile: g_buffer has only 32 index, but he/she tries to zero clear 1024 index. Bug Location: static uint8_t g_buffer[32]; : memset (g_buffer, 0, 1024); Note: Detected by CppCheck ---------------------------------------------------------- --- openair2/LAYER2/RLC/AM_v9.3.0/rlc_am_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/LAYER2/RLC/AM_v9.3.0/rlc_am_test.c b/openair2/LAYER2/RLC/AM_v9.3.0/rlc_am_test.c index 8e201a949b..86cafb89ce 100644 --- a/openair2/LAYER2/RLC/AM_v9.3.0/rlc_am_test.c +++ b/openair2/LAYER2/RLC/AM_v9.3.0/rlc_am_test.c @@ -228,7 +228,7 @@ void rlc_am_v9_3_0_test_read_write_bit_field() uint8_t* byte_pos_read = g_buffer; uint16_t read_value; - memset (g_buffer, 0, 1024); + memset (g_buffer, 0, sizeof(g_buffer)); // byte 0 rlc_am_write8_bit_field(&byte_pos_write, &bit_pos_write, 1, 1); rlc_am_write8_bit_field(&byte_pos_write, &bit_pos_write, 1, 0); From 893f36e81e1917b20f39b2cafeaf766c89037d82 Mon Sep 17 00:00:00 2001 From: gabrielC Date: Thu, 11 May 2017 11:58:49 +0200 Subject: [PATCH 6/7] bug fixes from Fujitsu (bug 29) ---------------------------------------------------------- bug 29 Ttile: FDD should be TDD. Bug Location: switch (oai_emulation.info.frame_type[0]) { case FDD: frame_type = "FDD"; break; case TDD: frame_type = "FDD"; break; } ---------------------------------------------------------- --- targets/SIMU/USER/oaisim_functions.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/targets/SIMU/USER/oaisim_functions.c b/targets/SIMU/USER/oaisim_functions.c index 8f357458ec..f6fc55852a 100644 --- a/targets/SIMU/USER/oaisim_functions.c +++ b/targets/SIMU/USER/oaisim_functions.c @@ -1486,7 +1486,7 @@ void init_ocm(void) break; case TDD: - frame_type = "FDD"; + frame_type = "TDD"; break; } From ad6d0ac59e28da0c44168ae17d0f771f1eb200fa Mon Sep 17 00:00:00 2001 From: gabrielC Date: Thu, 11 May 2017 13:55:20 +0200 Subject: [PATCH 7/7] bug fixes from Fujitsu (bug 37) ---------------------------------------------------------- bug 37 Ttile: Sending side is as follows. rar[3] = (((mcs&0x7)<<5)) | ((TPC&7)<<2) | ((ULdelay&1)<<1) | (cqireq&1); So, 2 bit shift looks correct. Bug Location: ulsch->harq_processes[harq_pid]->TPC = (rar[3]>>3)&7;//rar->TPC; ---------------------------------------------------------- --- openair1/PHY/LTE_TRANSPORT/rar_tools.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair1/PHY/LTE_TRANSPORT/rar_tools.c b/openair1/PHY/LTE_TRANSPORT/rar_tools.c index b7550d5573..2d29d8c13f 100644 --- a/openair1/PHY/LTE_TRANSPORT/rar_tools.c +++ b/openair1/PHY/LTE_TRANSPORT/rar_tools.c @@ -238,7 +238,7 @@ int generate_ue_ulsch_params_from_rar(PHY_VARS_UE *ue, - ulsch->harq_processes[harq_pid]->TPC = (rar[3]>>3)&7;//rar->TPC; + ulsch->harq_processes[harq_pid]->TPC = (rar[3]>>2)&7;//rar->TPC; rballoc = (((uint16_t)(rar[1]&7))<<7)|(rar[2]>>1); cqireq=rar[3]&1;