nr-rlc: bugfix: copy correct part of PDUs in case of segmentation

openair2/LAYER2/nr_rlc/nr_rlc_entity_am.c

@@ -218,7 +218,7 @@ static void reassemble_and_deliver(nr_rlc_entity_am_t *entity, int sn)
       bad_sdu = 1;
     }
     if (!bad_sdu && len > 0) {
-      memcpy(sdu + so, pdu->data, len);
+      memcpy(sdu + so, pdu->data + so - pdu->so, len);
       so += len;
     }
     free(pdu->data);

openair2/LAYER2/nr_rlc/nr_rlc_entity_um.c

@@ -148,7 +148,7 @@ static void reassemble_and_deliver(nr_rlc_entity_um_t *entity, int sn)
       bad_sdu = 1;
     }
     if (!bad_sdu && len > 0) {
-      memcpy(sdu + so, pdu->data, len);
+      memcpy(sdu + so, pdu->data + so - pdu->so, len);
       so += len;
     }
     free(pdu->data);

openair2/LAYER2/nr_rlc/tests/run_tests.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-test_count=15
+test_count=17
 
 for i in `seq $test_count`
 do

openair2/LAYER2/nr_rlc/tests/test16.h

@@ -0,0 +1,19 @@
+/*
+ * am test (SN field size 18):
+ * there was a bug when we receive a full PDU after receiving only the
+ * beginning of it; the data was copied at the end but from the start of the
+ * full PDU instead of the correct offset. This test captures this case.
+ * Gnb sends the start of a PDU then the full PDU. That is the SDU is
+ * [00 .. 09]. First gnb sends [00 .. 08] then it sends [00 .. 09].
+ */
+
+TIME, 1,
+    GNB_AM, 100000, 100000, 45, 35, 0, -1, -1, 8, 18,
+    UE_AM, 100000, 100000, 45, 35, 0, -1, -1, 8, 18,
+    GNB_PDU_SIZE, 12,
+    UE_PDU_SIZE, 20,
+    GNB_PDU, 12, 0x90, 0x00, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+TIME, 2,
+    GNB_PDU_SIZE, 20,
+    GNB_PDU, 13, 0xc0, 0x00, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
+TIME, -1

openair2/LAYER2/nr_rlc/tests/test17.h

@@ -0,0 +1,18 @@
+/*
+ * um test (SN field size 12):
+ * same problem as for test16, but we test by sending [00 .. 08] then
+ * [02 .. 09] (they overlap, the full SDU is [00 .. 09]), which probably
+ * never occurs in practice but triggers the bug. Doing as for test16 does
+ * not trigger the bug.
+ */
+
+TIME, 1,
+    GNB_UM, 100000, 100000, 35, 12,
+    UE_UM, 100000, 100000, 35, 12,
+    GNB_PDU_SIZE, 8,
+    UE_PDU_SIZE, 20,
+    GNB_PDU, 11, 0x40, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+TIME, 2,
+    GNB_PDU_SIZE, 20,
+    GNB_PDU, 12, 0x80, 0x00, 0x00, 0x02, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
+TIME, -1