Merge remote-tracking branch 'origin/fix-ue-mem-leaks' into integration_2025_w41 (!3689)

Fix OAI UE memory leaks

Fix 1: Replaced asn1cFreeStruc with ASN_STRUCT_FREE in MAC layer to properly
       free nested ASN.1 structures in cell group configuration.
Fix 2: Removed premature nullification of dedicatedNAS_Message->buf in
       dlInformationTransfer processing to allow proper ASN.1 cleanup.
Fix 3: Fixed memory ownership in nr_rrc_process_dedicatedNAS_MessageList by
       copying OCTET_STRING data instead of transferring ownership, preventing
       ASN.1 cleanup from losing track of allocated memory

Closes #828

openair2/RRC/NR_UE/L2_interface_ue.c

@@ -140,7 +140,7 @@ void process_msg_rcc_to_mac(nr_mac_rrc_message_t *msg, int instance_id)
       break;
     case NR_MAC_RRC_CONFIG_CG:
       nr_rrc_mac_config_req_cg(instance_id, 0, msg->payload.config_cg.cellGroupConfig, msg->payload.config_cg.UE_NR_Capability);
-      asn1cFreeStruc(asn_DEF_NR_CellGroupConfig, msg->payload.config_cg.cellGroupConfig);
+      ASN_STRUCT_FREE(asn_DEF_NR_CellGroupConfig, msg->payload.config_cg.cellGroupConfig);
       break;
     case NR_MAC_RRC_CONFIG_MIB:
       nr_rrc_mac_config_req_mib(instance_id,

openair2/RRC/NR_UE/rrc_UE.c

@@ -607,10 +607,10 @@ static void nr_rrc_process_dedicatedNAS_MessageList(NR_UE_RRC_INST_t *rrc, NR_RR
       nas_establish_cnf_t *msg = &NAS_CONN_ESTABLI_CNF(ittiMsg);
       msg->errCode = AS_SUCCESS;
       msg->nasMsg.length = tmp->list.array[i]->size;
-      msg->nasMsg.nas_data = tmp->list.array[i]->buf;
+      msg->nasMsg.nas_data = malloc_or_fail(msg->nasMsg.length);
+      memcpy(msg->nasMsg.nas_data, tmp->list.array[i]->buf, msg->nasMsg.length);
       itti_send_msg_to_task(TASK_NAS_NRUE, rrc->ue_id, ittiMsg);
     }
-    tmp->list.count = 0; // to prevent the automatic free by ASN1_FREE
   }
 }
 
@@ -2299,7 +2299,6 @@ static int nr_rrc_ue_decode_dcch(NR_UE_RRC_INST_t *rrc,
               msg->nasMsg.nas_data = malloc(msg->nasMsg.length);
               memcpy(msg->nasMsg.nas_data, dedicatedNAS_Message->buf, msg->nasMsg.length);
               itti_send_msg_to_task(TASK_NAS_NRUE, rrc->ue_id, ittiMsg);
-              dedicatedNAS_Message->buf = NULL; // to keep the buffer, up to NAS to free it
             }
           }
         } break;