Fix asn1c double free
The UE stores PDCCH search spaces from the network in NR_BWP_PDCCH_t struct within NR_UE_MAC_INST_t. After storing, the pointers otherSI_SS, ra_SS and paging_SS are updated to point to the stored SS. Multiple pointers could point to the same stored SS struct depending on configuration. Then when the UE wants to release the SS, the pointers are used to free the stored SS using ASN_STRUCT_RESET(). If multiple pointers point to the same SS, calling ASN_STRUCT_RESET() on all pointers would lead to double free. So one needs to check for dangling pointer before freeing. Instead of using pointers and assigning them during configuration, we use SS id for otherSI_SS, ra_SS and paging_SS to retrieve the pointers whenever needed. When the UE wants to release the SS, we make them -1 indicating an invalid SS id.
This commit is contained in:
@@ -228,5 +228,9 @@ static inline uint64_t BIT_STRING_to_uint64(const BIT_STRING_t *asn) {
|
||||
free(STRUCT); \
|
||||
STRUCT = NULL; \
|
||||
} while (0)
|
||||
#define asn1cFreeSeq(ASN_DEF, LIST) \
|
||||
do { \
|
||||
ASN_STRUCT_FREE(ASN_DEF, LIST.array[--LIST.count]); \
|
||||
} while (LIST.count > 0) \
|
||||
|
||||
#endif
|
||||
|
||||
Reference in New Issue
Block a user