maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

a small out of buffer access, likely only santize addr detection

Browse Source
This commit is contained in:
Laurent Thomas
2022-04-08 18:22:40 +02:00
committed by Robert Schmidt
parent 1a2be8fc89
commit 8623bc6690
1 changed files with 39 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair1/PHY/NR_TRANSPORT/nr_dlsch.c
+9 -12
View File
@@ -98,7 +98,6 @@ void nr_generate_pdsch(processingData_L1tx_t *msgTx,
uint16_t nb_re = ((12*rel15->NrOfSymbols)-nb_re_dmrs*dmrs_len-xOverhead)*rel15->rbSize*rel15->nrOfLayers; uint16_t nb_re = ((12*rel15->NrOfSymbols)-nb_re_dmrs*dmrs_len-xOverhead)*rel15->rbSize*rel15->nrOfLayers;
uint8_t Qm = rel15->qamModOrder[0]; uint8_t Qm = rel15->qamModOrder[0];
uint32_t encoded_length = nb_re*Qm; uint32_t encoded_length = nb_re*Qm;
uint32_t scrambled_output[rel15->NrOfCodewords][(encoded_length>>5)+1];
int16_t mod_dmrs[n_dmrs<<1] __attribute__ ((aligned(16))); int16_t mod_dmrs[n_dmrs<<1] __attribute__ ((aligned(16)));
/* PTRS */ /* PTRS */
@@ -147,33 +146,30 @@ void nr_generate_pdsch(processingData_L1tx_t *msgTx,
printf("\n"); printf("\n");
#endif #endif
for (int q=0; q<rel15->NrOfCodewords; q++) {
/// scrambling /// scrambling
start_meas(dlsch_scrambling_stats); start_meas(dlsch_scrambling_stats);
for (int q=0; q<rel15->NrOfCodewords; q++) { uint32_t scrambled_output[(encoded_length>>5)+4]; // modulator acces by 4 bytes in some cases
memset((void*)scrambled_output[q], 0, ((encoded_length>>5)+1)*sizeof(uint32_t)); memset(scrambled_output, 0, sizeof(scrambled_output));
if ( encoded_length > rel15->rbSize * NR_SYMBOLS_PER_SLOT * NR_NB_SC_PER_RB * Qm * rel15->nrOfLayers) abort();
nr_pdsch_codeword_scrambling(output, nr_pdsch_codeword_scrambling(output,
encoded_length, encoded_length,
q, q,
rel15->dataScramblingId, rel15->dataScramblingId,
rel15->rnti, rel15->rnti,
scrambled_output[q]); scrambled_output);
}
stop_meas(dlsch_scrambling_stats);
#ifdef DEBUG_DLSCH #ifdef DEBUG_DLSCH
printf("PDSCH scrambling:\n"); printf("PDSCH scrambling:\n");
for (int i=0; i<encoded_length>>8; i++) { for (int i=0; i<encoded_length>>8; i++) {
for (int j=0; j<8; j++) for (int j=0; j<8; j++)
printf("0x%08x\t", scrambled_output[0][(i<<3)+j]); printf("0x%08x\t", scrambled_output[(i<<3)+j]);
printf("\n"); printf("\n");
} }
#endif #endif
stop_meas(dlsch_scrambling_stats);
/// Modulation /// Modulation
start_meas(dlsch_modulation_stats); start_meas(dlsch_modulation_stats);
VCD_SIGNAL_DUMPER_DUMP_FUNCTION_BY_NAME(VCD_SIGNAL_DUMPER_FUNCTIONS_gNB_PDSCH_MODULATION, 1); nr_modulation(scrambled_output,
for (int q=0; q<rel15->NrOfCodewords; q++)
nr_modulation(scrambled_output[q],
encoded_length, encoded_length,
Qm, Qm,
mod_symbs[q]); mod_symbs[q]);
@@ -188,6 +184,7 @@ void nr_generate_pdsch(processingData_L1tx_t *msgTx,
printf("\n"); printf("\n");
} }
#endif #endif
}
start_meas(&gNB->dlsch_layer_mapping_stats); start_meas(&gNB->dlsch_layer_mapping_stats);
/// Layer mapping /// Layer mapping