From 0cbed89b03c5201ae95184d0bf9519cada2d0569 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Tue, 23 Sep 2025 14:20:39 +0200 Subject: [PATCH] Replace malloc_or_fail with calloc_or_fail for safer memory allocation - Update encoder functions in ngap_gNB_mobility_management.c to use calloc_or_fail - Provides zero-initialized memory and consistent error handling - Prevents uninitialized fields and improves memory safety Also: - Update NG Setup Request to use calloc_or_fail --- openair3/NGAP/ngap_gNB.c | 18 +++++++++--------- openair3/NGAP/ngap_gNB_mobility_management.c | 14 +++++++------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/openair3/NGAP/ngap_gNB.c b/openair3/NGAP/ngap_gNB.c index 7cc8041ad5..fb4d6c135b 100644 --- a/openair3/NGAP/ngap_gNB.c +++ b/openair3/NGAP/ngap_gNB.c @@ -677,7 +677,7 @@ static int ngap_gNB_generate_ng_setup_request( pdu.choice.initiatingMessage->value.present = NGAP_InitiatingMessage__value_PR_NGSetupRequest; out = &pdu.choice.initiatingMessage->value.choice.NGSetupRequest; /* mandatory */ - ie = (NGAP_NGSetupRequestIEs_t *)calloc(1, sizeof(NGAP_NGSetupRequestIEs_t)); + ie = calloc_or_fail(1, sizeof(NGAP_NGSetupRequestIEs_t)); ie->id = NGAP_ProtocolIE_ID_id_GlobalRANNodeID; ie->criticality = NGAP_Criticality_reject; ie->value.present = NGAP_NGSetupRequestIEs__value_PR_GlobalRANNodeID; @@ -700,7 +700,7 @@ static int ngap_gNB_generate_ng_setup_request( /* optional */ if (instance_p->gNB_name) { - ie = (NGAP_NGSetupRequestIEs_t *)calloc(1, sizeof(NGAP_NGSetupRequestIEs_t)); + ie = calloc_or_fail(1, sizeof(NGAP_NGSetupRequestIEs_t)); ie->id = NGAP_ProtocolIE_ID_id_RANNodeName; ie->criticality = NGAP_Criticality_ignore; ie->value.present = NGAP_NGSetupRequestIEs__value_PR_RANNodeName; @@ -710,28 +710,28 @@ static int ngap_gNB_generate_ng_setup_request( } /* mandatory */ - ie = (NGAP_NGSetupRequestIEs_t *)calloc(1, sizeof(NGAP_NGSetupRequestIEs_t)); + ie = calloc_or_fail(1, sizeof(NGAP_NGSetupRequestIEs_t)); ie->id = NGAP_ProtocolIE_ID_id_SupportedTAList; ie->criticality = NGAP_Criticality_reject; ie->value.present = NGAP_NGSetupRequestIEs__value_PR_SupportedTAList; { - ta = (NGAP_SupportedTAItem_t *)calloc(1, sizeof(NGAP_SupportedTAItem_t)); + ta = (NGAP_SupportedTAItem_t *)calloc_or_fail(1, sizeof(NGAP_SupportedTAItem_t)); INT24_TO_OCTET_STRING(instance_p->tac, &ta->tAC); { for (int i = 0; i < ngap_amf_data_p->broadcast_plmn_num; ++i) { - plmn = (NGAP_BroadcastPLMNItem_t *)calloc(1, sizeof(NGAP_BroadcastPLMNItem_t)); + plmn = (NGAP_BroadcastPLMNItem_t *)calloc_or_fail(1, sizeof(NGAP_BroadcastPLMNItem_t)); ngap_plmn_t *plmn_req = &instance_p->plmn[ngap_amf_data_p->broadcast_plmn_index[i]]; plmn_id_t *plmn_id = &instance_p->plmn[ngap_amf_data_p->broadcast_plmn_index[i]].plmn; MCC_MNC_TO_TBCD(plmn_id->mcc, plmn_id->mnc, plmn_id->mnc_digit_length, &plmn->pLMNIdentity); for (int si = 0; si < plmn_req->num_nssai; si++) { - ssi = (NGAP_SliceSupportItem_t *)calloc(1, sizeof(NGAP_SliceSupportItem_t)); + ssi = (NGAP_SliceSupportItem_t *)calloc_or_fail(1, sizeof(NGAP_SliceSupportItem_t)); INT8_TO_OCTET_STRING(plmn_req->s_nssai[si].sst, &ssi->s_NSSAI.sST); const uint32_t sd = plmn_req->s_nssai[si].sd; if (sd != 0xffffff) { - ssi->s_NSSAI.sD = calloc(1, sizeof(NGAP_SD_t)); - ssi->s_NSSAI.sD->buf = calloc(3, sizeof(uint8_t)); + ssi->s_NSSAI.sD = calloc_or_fail(1, sizeof(NGAP_SD_t)); + ssi->s_NSSAI.sD->buf = calloc_or_fail(3, sizeof(uint8_t)); ssi->s_NSSAI.sD->size = 3; ssi->s_NSSAI.sD->buf[0] = (sd & 0xff0000) >> 16; ssi->s_NSSAI.sD->buf[1] = (sd & 0x00ff00) >> 8; @@ -749,7 +749,7 @@ static int ngap_gNB_generate_ng_setup_request( asn1cSeqAdd(&out->protocolIEs.list, ie); /* mandatory */ - ie = (NGAP_NGSetupRequestIEs_t *)calloc(1, sizeof(NGAP_NGSetupRequestIEs_t)); + ie = calloc_or_fail(1, sizeof(NGAP_NGSetupRequestIEs_t)); ie->id = NGAP_ProtocolIE_ID_id_DefaultPagingDRX; ie->criticality = NGAP_Criticality_ignore; ie->value.present = NGAP_NGSetupRequestIEs__value_PR_PagingDRX; diff --git a/openair3/NGAP/ngap_gNB_mobility_management.c b/openair3/NGAP/ngap_gNB_mobility_management.c index a6ff4b39a1..95290f7bc3 100644 --- a/openair3/NGAP/ngap_gNB_mobility_management.c +++ b/openair3/NGAP/ngap_gNB_mobility_management.c @@ -37,7 +37,7 @@ * (9.2.3.1 of 3GPP TS 38.413) NG-RAN node → AMF */ NGAP_NGAP_PDU_t *encode_ng_handover_required(const ngap_handover_required_t *msg) { - NGAP_NGAP_PDU_t *pdu = malloc_or_fail(sizeof(*pdu)); + NGAP_NGAP_PDU_t *pdu = calloc_or_fail(1, sizeof(*pdu)); /* Prepare the NGAP message to encode */ pdu->present = NGAP_NGAP_PDU_PR_initiatingMessage; @@ -198,7 +198,7 @@ NGAP_NGAP_PDU_t *encode_ng_handover_required(const ngap_handover_required_t *msg NGAP_NGAP_PDU_t *encode_ng_handover_failure(const ngap_handover_failure_t *msg) { - NGAP_NGAP_PDU_t *pdu = malloc_or_fail(sizeof(*pdu)); + NGAP_NGAP_PDU_t *pdu = calloc_or_fail(1, sizeof(*pdu)); /* Prepare the NGAP message to encode */ pdu->present = NGAP_NGAP_PDU_PR_unsuccessfulOutcome; @@ -283,7 +283,7 @@ int decode_ng_handover_request(ngap_handover_request_t *out, const NGAP_NGAP_PDU // Mobility Restriction List (O) NGAP_FIND_PROTOCOLIE_BY_ID(NGAP_HandoverRequestIEs_t, ie, container, NGAP_ProtocolIE_ID_id_MobilityRestrictionList, false); if (ie != NULL) { - out->mobility_restriction = malloc_or_fail(sizeof(*out->mobility_restriction)); + out->mobility_restriction = calloc_or_fail(1, sizeof(*out->mobility_restriction)); *out->mobility_restriction = decode_ngap_mobility_restriction(&ie->value.choice.MobilityRestrictionList); } @@ -385,7 +385,7 @@ int decode_ng_handover_request(ngap_handover_request_t *out, const NGAP_NGAP_PDU NGAP_NGAP_PDU_t *encode_ng_handover_request_ack(ngap_handover_request_ack_t *msg) { - NGAP_NGAP_PDU_t *pdu = malloc_or_fail(sizeof(*pdu)); + NGAP_NGAP_PDU_t *pdu = calloc_or_fail(1, sizeof(*pdu)); pdu->present = NGAP_NGAP_PDU_PR_successfulOutcome; asn1cCalloc(pdu->choice.successfulOutcome, head); @@ -453,7 +453,7 @@ NGAP_NGAP_PDU_t *encode_ng_handover_request_ack(ngap_handover_request_ack_t *msg for (int j = 0; j < msg->pdusessions[pduSesIdx].ack_transfer.nb_of_qos_flow; j++) { asn1cSequenceAdd(transfer.qosFlowSetupResponseList.list, NGAP_QosFlowItemWithDataForwarding_t, qosItem); qosItem->qosFlowIdentifier = msg->pdusessions[pduSesIdx].ack_transfer.qos_setup_list[j].qfi; - qosItem->dataForwardingAccepted = malloc_or_fail(sizeof(*qosItem->dataForwardingAccepted)); + qosItem->dataForwardingAccepted = calloc_or_fail(1, sizeof(*qosItem->dataForwardingAccepted)); *qosItem->dataForwardingAccepted = NGAP_DataForwardingAccepted_data_forwarding_accepted; } @@ -565,7 +565,7 @@ void free_ng_handover_command(ngap_handover_command_t *msg) NGAP_NGAP_PDU_t *encode_ng_handover_notify(const ngap_handover_notify_t *msg) { - NGAP_NGAP_PDU_t *pdu = malloc_or_fail(sizeof(*pdu)); + NGAP_NGAP_PDU_t *pdu = calloc_or_fail(1, sizeof(*pdu)); // Message Type (M) pdu->present = NGAP_NGAP_PDU_PR_initiatingMessage; @@ -682,7 +682,7 @@ int decode_ng_handover_cancel_ack(ngap_handover_cancel_ack_t *out, const NGAP_NG /** @brief Encode NGAP UL RAN Status Transfer (9.2.3.14 of 3GPP TS 38.413) */ NGAP_NGAP_PDU_t *encode_ng_ul_ran_status_transfer(const ngap_ran_status_transfer_t *msg) { - NGAP_NGAP_PDU_t *pdu = malloc_or_fail(sizeof(*pdu)); + NGAP_NGAP_PDU_t *pdu = calloc_or_fail(1, sizeof(*pdu)); pdu->present = NGAP_NGAP_PDU_PR_initiatingMessage; asn1cCalloc(pdu->choice.initiatingMessage, head); head->procedureCode = NGAP_ProcedureCode_id_UplinkRANStatusTransfer;