maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid NULL access in rrc_eNB_process_RRCConnectionReestablishmentComplete.

Browse Source
This commit is contained in:
Masayuki HARADA
2018-02-22 11:11:15 +09:00
parent de35844c42
commit 59623646cf
1 changed files with 47 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair2/RRC/LITE/rrc_eNB.c
+16 -2
View File
@@ -1371,8 +1371,10 @@ rrc_eNB_process_RRCConnectionReestablishmentComplete(
SRB_configList2 = &ue_context_pP->ue_context.SRB_configList2[xid]; SRB_configList2 = &ue_context_pP->ue_context.SRB_configList2[xid];
// get old configuration of SRB2 // get old configuration of SRB2
if (*SRB_configList2 != NULL) { if (*SRB_configList2 != NULL) {
if((*SRB_configList2)->list.count!=0){
LOG_D(RRC, "SRB_configList2(%p) count is %d\n SRB_configList2->list.array[0] addr is %p", LOG_D(RRC, "SRB_configList2(%p) count is %d\n SRB_configList2->list.array[0] addr is %p",
SRB_configList2, (*SRB_configList2)->list.count, (*SRB_configList2)->list.array[0]); SRB_configList2, (*SRB_configList2)->list.count, (*SRB_configList2)->list.array[0]);
}
for (i = 0; (i < (*SRB_configList2)->list.count) && (i < 3); i++) { for (i = 0; (i < (*SRB_configList2)->list.count) && (i < 3); i++) {
if ((*SRB_configList2)->list.array[i]->srb_Identity == 2 ){ if ((*SRB_configList2)->list.array[i]->srb_Identity == 2 ){
LOG_D(RRC, "get SRB2_config from (ue_context_pP->ue_context.SRB_configList2[%d])\n", xid); LOG_D(RRC, "get SRB2_config from (ue_context_pP->ue_context.SRB_configList2[%d])\n", xid);
@@ -1384,10 +1386,14 @@ rrc_eNB_process_RRCConnectionReestablishmentComplete(
SRB_configList2 = &ue_context_pP->ue_context.SRB_configList2[next_xid]; SRB_configList2 = &ue_context_pP->ue_context.SRB_configList2[next_xid];
DRB_configList2 = &ue_context_pP->ue_context.DRB_configList2[next_xid]; DRB_configList2 = &ue_context_pP->ue_context.DRB_configList2[next_xid];
if(SRB_configList2!=NULL){
if (*SRB_configList2) { if (*SRB_configList2) {
free(*SRB_configList2); free(*SRB_configList2);
LOG_D(RRC, "free(ue_context_pP->ue_context.SRB_configList2[%d])\n", next_xid); LOG_D(RRC, "free(ue_context_pP->ue_context.SRB_configList2[%d])\n", next_xid);
} }
}else{
LOG_E(RRC, "SRB_configList2 is null\n");
}
*SRB_configList2 = CALLOC(1, sizeof(**SRB_configList2)); *SRB_configList2 = CALLOC(1, sizeof(**SRB_configList2));
if (SRB2_config != NULL) { if (SRB2_config != NULL) {
// Add SRB2 to SRB configuration list // Add SRB2 to SRB configuration list
@@ -1406,10 +1412,14 @@ rrc_eNB_process_RRCConnectionReestablishmentComplete(
if(DRB_configList2!=NULL){
if (*DRB_configList2) { if (*DRB_configList2) {
free(*DRB_configList2); free(*DRB_configList2);
LOG_D(RRC, "free(ue_context_pP->ue_context.DRB_configList2[%d])\n", next_xid); LOG_D(RRC, "free(ue_context_pP->ue_context.DRB_configList2[%d])\n", next_xid);
} }
}else{
LOG_E(RRC, "DRB_configList2 is null\n");
}
*DRB_configList2 = CALLOC(1, sizeof(**DRB_configList2)); *DRB_configList2 = CALLOC(1, sizeof(**DRB_configList2));
if (DRB_configList != NULL) { if (DRB_configList != NULL) {
@@ -1863,7 +1873,11 @@ rrc_eNB_process_RRCConnectionReestablishmentComplete(
} }
#endif #endif
if(size==65535){
LOG_E(RRC,"RRC decode err!!! do_RRCConnectionReconfiguration\n");
put_UE_in_freelist(ctxt_pP->module_id, reestablish_rnti, 0);
return;
}else{
LOG_I(RRC, LOG_I(RRC,
"[eNB %d] Frame %d, Logical Channel DL-DCCH, Generate RRCConnectionReconfiguration (bytes %d, UE id %x)\n", "[eNB %d] Frame %d, Logical Channel DL-DCCH, Generate RRCConnectionReconfiguration (bytes %d, UE id %x)\n",
ctxt_pP->module_id, ctxt_pP->frame, size, ue_context_pP->ue_context.rnti); ctxt_pP->module_id, ctxt_pP->frame, size, ue_context_pP->ue_context.rnti);
@@ -1891,7 +1905,7 @@ rrc_eNB_process_RRCConnectionReestablishmentComplete(
size, size,
buffer, buffer,
PDCP_TRANSMISSION_MODE_CONTROL); PDCP_TRANSMISSION_MODE_CONTROL);
}
// delete UE data of prior RNTI. UE use current RNTI. // delete UE data of prior RNTI. UE use current RNTI.
// protocol_ctxt_t ctxt_prior = *ctxt_pP; // protocol_ctxt_t ctxt_prior = *ctxt_pP;
// ctxt_prior.rnti = reestablish_rnti; // ctxt_prior.rnti = reestablish_rnti;