From 7ddaa8ed1b3760d8bc1447b9615c69c53870d869 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 10:41:17 +0900 Subject: [PATCH 01/86] Fix Coverity Scan CID 300489 (Variable neigh_meas going out of scope leaks the storage it points to.) --- openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c b/openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c index dfc50683ff..aa7a402f2b 100644 --- a/openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c +++ b/openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c @@ -412,8 +412,10 @@ int flexran_agent_rrc_stats_reply(mid_t mod_id, if (neigh_meas->n_eutra_meas > 0){ eutra_meas = malloc(sizeof(Protocol__FlexEutraMeasurements) * neigh_meas->n_eutra_meas); - if (eutra_meas == NULL) + if (eutra_meas == NULL) { + free(neigh_meas); goto error; + } for (int j = 0; j < neigh_meas->n_eutra_meas; j++ ){ @@ -423,6 +425,7 @@ int flexran_agent_rrc_stats_reply(mid_t mod_id, free(eutra_meas[k]); } free(eutra_meas); + free(neigh_meas); goto error; } @@ -453,6 +456,8 @@ int flexran_agent_rrc_stats_reply(mid_t mod_id, rrc_measurements->neigh_meas = neigh_meas; + } else { + free(neigh_meas); } ue_report[i]->rrc_measurements = rrc_measurements; From 03cc588652ab1f859b109851aea521aa62e157c6 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 10:42:57 +0900 Subject: [PATCH 02/86] Fix Coverity Scan CID 300471 (Using uninitialized value queue->mutex when calling free.) --- openair2/ENB_APP/flexran_agent_task_manager.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/ENB_APP/flexran_agent_task_manager.c b/openair2/ENB_APP/flexran_agent_task_manager.c index 088ec618c7..4a0fee1f5b 100644 --- a/openair2/ENB_APP/flexran_agent_task_manager.c +++ b/openair2/ENB_APP/flexran_agent_task_manager.c @@ -77,6 +77,7 @@ flexran_agent_task_queue_t *flexran_agent_task_queue_init(mid_t mod_id, size_t c if (queue == NULL) goto error; + queue->mutex = NULL; /* If no comparator was given, use the default one */ if (cmp == NULL) queue->cmp = _flexran_agent_task_queue_cmp; From 4ab9c49a1372c795b6fac7723bbb05b82d9e1ea2 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 10:44:05 +0900 Subject: [PATCH 03/86] Fix Coverity Scan CID 300464 (Using hi as an array. This might corrupt or misinterpret adjacent memory locations.) --- openair2/LAYER2/MAC/eNB_scheduler_primitives.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/openair2/LAYER2/MAC/eNB_scheduler_primitives.c b/openair2/LAYER2/MAC/eNB_scheduler_primitives.c index 0385ae6730..3e58204659 100644 --- a/openair2/LAYER2/MAC/eNB_scheduler_primitives.c +++ b/openair2/LAYER2/MAC/eNB_scheduler_primitives.c @@ -5140,8 +5140,8 @@ nack_or_dtx_reported(COMMON_channels_t *cc, if (cc->tdd_Config) { nfapi_harq_indication_tdd_rel13_t *hi = &harq_pdu->harq_indication_tdd_rel13; - for (i = 0; i < hi->number_of_ack_nack; hi++) { - if (hi->harq_data[0].bundling.value_0 != 1) //only bundling is used for tdd for now + for (i = 0; i < hi->number_of_ack_nack; i++) { + if (hi->harq_data[i].bundling.value_0 != 1) //only bundling is used for tdd for now return 1; } @@ -5150,7 +5150,7 @@ nack_or_dtx_reported(COMMON_channels_t *cc, nfapi_harq_indication_fdd_rel13_t *hi = &harq_pdu->harq_indication_fdd_rel13; - for (i = 0; i < hi->number_of_ack_nack; hi++) { + for (i = 0; i < hi->number_of_ack_nack; i++) { if (hi->harq_tb_n[i] != 1) return 1; } From d0f3c98b26b312cfc0b251802d7a5e1ebce7863e Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 10:45:00 +0900 Subject: [PATCH 04/86] Fix Coverity Scan CID 300460 (Using uninitialized value fp->eutra_band when calling from_earfcn.) --- nfapi/oai_integration/nfapi_pnf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/nfapi/oai_integration/nfapi_pnf.c b/nfapi/oai_integration/nfapi_pnf.c index a4b83e613b..c835f38e11 100644 --- a/nfapi/oai_integration/nfapi_pnf.c +++ b/nfapi/oai_integration/nfapi_pnf.c @@ -540,6 +540,7 @@ int config_request(nfapi_pnf_config_t *config, nfapi_pnf_phy_config_t *phy, nfap } if(req->nfapi_config.earfcn.tl.tag == NFAPI_NFAPI_EARFCN_TAG) { + fp->eutra_band = 0; fp->dl_CarrierFreq = from_earfcn(fp->eutra_band, req->nfapi_config.earfcn.value); fp->ul_CarrierFreq = fp->dl_CarrierFreq - (get_uldl_offset(fp->eutra_band) * 1e5); num_tlv++; From 097d78cab146e0197972ba06c076d4af682c27c0 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 10:51:06 +0900 Subject: [PATCH 05/86] Fix Coverity Scan CID 300393 (Variable copy going out of scope leaks the storage it points to.) --- .../MAC/flexran_agent_mac_internal.c | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c b/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c index 2a7d1fe186..890067aab9 100644 --- a/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c +++ b/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c @@ -555,6 +555,74 @@ Protocol__FlexDlCsi * copy_csi_report(Protocol__FlexDlCsi * original) { return copy; error: + if (copy != NULL) { + if ((copy->p11csi != NULL) && (copy->p11csi->wb_cqi != NULL)) { + free(copy->p11csi->wb_cqi); + copy->p11csi->wb_cqi = NULL; + } + if (copy->p21csi != NULL) { + if (copy->p21csi->wb_cqi != NULL) { + free(copy->p21csi->wb_cqi); + copy->p21csi->wb_cqi = NULL; + } + if (copy->p21csi->sb_cqi != NULL) { + free(copy->p21csi->sb_cqi); + copy->p21csi->sb_cqi = NULL; + } + } + if (copy->a12csi != NULL) { + if (copy->a12csi->wb_cqi != NULL) { + free(copy->a12csi->wb_cqi); + copy->a12csi->wb_cqi = NULL; + } + if (copy->a12csi->sb_pmi != NULL) { + free(copy->a12csi->sb_pmi); + copy->a12csi->sb_pmi = NULL; + } + } + if (copy->a22csi != NULL) { + if (copy->a22csi->wb_cqi != NULL) { + free(copy->a22csi->wb_cqi); + copy->a22csi->wb_cqi = NULL; + } + if (copy->a22csi->sb_cqi != NULL) { + free(copy->a22csi->sb_cqi); + copy->a22csi->sb_cqi = NULL; + } + if (copy->a22csi->sb_list != NULL) { + free(copy->a22csi->sb_list); + copy->a22csi->sb_list = NULL; + } + } + if ((copy->a20csi != NULL) && (copy->a20csi->sb_list != NULL)) { + free(copy->a20csi->sb_list); + copy->a20csi->sb_list = NULL; + } + if ((copy->a30csi != NULL) && (copy->a30csi->sb_cqi != NULL)) { + free(copy->a30csi->sb_cqi); + copy->a30csi->sb_cqi = NULL; + } + if (copy->a31csi != NULL) { + if (copy->a31csi->wb_cqi != NULL) { + free(copy->a31csi->wb_cqi); + copy->a31csi->wb_cqi = NULL; + } + if (copy->a31csi->sb_cqi != NULL) { + for (i = 0; i < copy->a31csi->n_sb_cqi; i++) { + if (copy->a31csi->sb_cqi[i] != NULL) { + if (copy->a31csi->sb_cqi[i]->sb_cqi != NULL) { + free(copy->a31csi->sb_cqi[i]->sb_cqi); + } + free(copy->a31csi->sb_cqi[i]); + } + } + free(copy->a31csi->sb_cqi); + copy->a31csi->sb_cqi = NULL; + } + } + free(copy); + copy = NULL; + } return NULL; } From a9e9488cd264dfa59ff28bac0dfce74939fe4b90 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 10:54:34 +0900 Subject: [PATCH 06/86] Fix Coverity Scan CID 300392 (Variable dl_report going out of scope leaks the storage it points to.) --- .../CONTROL_MODULES/MAC/flexran_agent_mac_internal.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c b/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c index 890067aab9..6903d18a5b 100644 --- a/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c +++ b/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c @@ -361,6 +361,14 @@ Protocol__FlexDlCqiReport * copy_dl_cqi_report(Protocol__FlexDlCqiReport * origi error: /*TODO: Must free memory properly*/ + if (dl_report != NULL) { + if (csi_reports != NULL) { + free(csi_reports); + csi_reports = NULL; + } + free(dl_report); + dl_report = NULL; + } return NULL; } From 42e3a1394d793b396ec6256db2ea9c8829124466 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 10:55:36 +0900 Subject: [PATCH 07/86] Fix Coverity Scan CID 300388 (Variable destinationInfoList going out of scope leaks the storage it points to.) --- openair2/RRC/LTE/rrc_eNB.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index 1dd3a26053..46a7c287e4 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -8074,6 +8074,9 @@ rrc_eNB_process_SidelinkUEInformation( //generate RRC Reconfiguration rrc_eNB_generate_RRCConnectionReconfiguration_Sidelink(ctxt_pP, ue_context_pP, destinationInfoList, 0); + + free(destinationInfoList); + destinationInfoList = NULL; return 0; } @@ -8092,6 +8095,9 @@ rrc_eNB_process_SidelinkUEInformation( //generate RRC Reconfiguration rrc_eNB_generate_RRCConnectionReconfiguration_Sidelink(ctxt_pP, ue_context_pP, destinationInfoList, 0); + + free(destinationInfoList); + destinationInfoList = NULL; return 0; } } @@ -8113,6 +8119,9 @@ rrc_eNB_process_SidelinkUEInformation( //generate RRC Reconfiguration rrc_eNB_generate_RRCConnectionReconfiguration_Sidelink(ctxt_pP, ue_context_pP, destinationInfoList, 0); + + free(destinationInfoList); + destinationInfoList = NULL; return 0; } } @@ -8134,6 +8143,9 @@ rrc_eNB_process_SidelinkUEInformation( //generate RRC Reconfiguration rrc_eNB_generate_RRCConnectionReconfiguration_Sidelink(ctxt_pP, ue_context_pP, destinationInfoList, 0); + + free(destinationInfoList); + destinationInfoList = NULL; return 0; } } From db3cfa8b7bfc7c9fac8e5f4ce98fd67c73a53109 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 10:56:43 +0900 Subject: [PATCH 08/86] Fix Coverity Scan CID 300387 (Using freed pointer req_msg.) --- openair2/ENB_APP/flexran_agent_handler.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/openair2/ENB_APP/flexran_agent_handler.c b/openair2/ENB_APP/flexran_agent_handler.c index 0c2c32e4d6..6c2e6429eb 100644 --- a/openair2/ENB_APP/flexran_agent_handler.c +++ b/openair2/ENB_APP/flexran_agent_handler.c @@ -745,11 +745,14 @@ err_code_t flexran_agent_enable_cont_stats_update(mid_t mod_id, Protocol__FlexranMessage *req_msg = NULL; flexran_agent_stats_request(mod_id, xid, stats_req, &req_msg); - stats_context[mod_id].stats_req = req_msg; - stats_context[mod_id].prev_stats_reply = NULL; - stats_context[mod_id].cont_update = 1; - stats_context[mod_id].xid = xid; + if (req_msg != NULL) { + stats_context[mod_id].stats_req = req_msg; + stats_context[mod_id].prev_stats_reply = NULL; + + stats_context[mod_id].cont_update = 1; + stats_context[mod_id].xid = xid; + } if (pthread_mutex_unlock(stats_context[mod_id].mutex)) { goto error; From 401002738088efaea5e69fcd89d075d12cb946d4 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 10:58:21 +0900 Subject: [PATCH 09/86] Fix Coverity Scan CID 300384 (Variable rrc_measurements going out of scope leaks the storage it points to.) --- openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c b/openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c index aa7a402f2b..fc8a9ba337 100644 --- a/openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c +++ b/openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c @@ -400,8 +400,11 @@ int flexran_agent_rrc_stats_reply(mid_t mod_id, /* Target Cell, Neghibouring*/ Protocol__FlexNeighCellsMeasurements *neigh_meas; neigh_meas = malloc(sizeof(Protocol__FlexNeighCellsMeasurements)); - if (neigh_meas == NULL) + if (neigh_meas == NULL) { + free(rrc_measurements); + rrc_measurements = NULL; goto error; + } protocol__flex_neigh_cells_measurements__init(neigh_meas); @@ -414,6 +417,8 @@ int flexran_agent_rrc_stats_reply(mid_t mod_id, eutra_meas = malloc(sizeof(Protocol__FlexEutraMeasurements) * neigh_meas->n_eutra_meas); if (eutra_meas == NULL) { free(neigh_meas); + free(rrc_measurements); + rrc_measurements = NULL; goto error; } @@ -426,6 +431,8 @@ int flexran_agent_rrc_stats_reply(mid_t mod_id, } free(eutra_meas); free(neigh_meas); + free(rrc_measurements); + rrc_measurements = NULL; goto error; } From fdb47bed67d3ce34febbf96e953a65438b79fd55 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 10:59:59 +0900 Subject: [PATCH 10/86] Fix Coverity Scan CID 300383 (Variable sl_CommConfig going out of scope leaks the storage it points to.) --- openair2/RRC/LTE/rrc_eNB.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index 46a7c287e4..7b70c9564e 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -8257,9 +8257,10 @@ rrc_eNB_generate_RRCConnectionReconfiguration_Sidelink( LTE_SL_CommConfig_r12_t rrc_eNB_get_sidelink_commTXPool( const protocol_ctxt_t *const ctxt_pP, rrc_eNB_ue_context_t *const ue_context_pP, LTE_SL_DestinationInfoList_r12_t *destinationInfoList ) { // for the moment, use scheduled resource allocation - LTE_SL_CommConfig_r12_t *sl_CommConfig; + LTE_SL_CommConfig_r12_t sl_CommConfig_r12; + LTE_SL_CommConfig_r12_t *sl_CommConfig = &sl_CommConfig_r12; LTE_SL_CommResourcePool_r12_t *sc_CommTxConfig; - sl_CommConfig = CALLOC(1, sizeof(struct LTE_SL_CommConfig_r12)); + memset(sl_CommConfig,0,sizeof(LTE_SL_CommConfig_r12_t)); sl_CommConfig->commTxResources_r12 = CALLOC(1, sizeof(*sl_CommConfig->commTxResources_r12)); sl_CommConfig->commTxResources_r12->present = LTE_SL_CommConfig_r12__commTxResources_r12_PR_setup; sl_CommConfig->commTxResources_r12->choice.setup.present = LTE_SL_CommConfig_r12__commTxResources_r12__setup_PR_scheduled_r12; From 525e0da71411c14ed7ceedf22993fb03240baaa5 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:01:19 +0900 Subject: [PATCH 11/86] Fix Coverity Scan CID 300379 (Variable csi_reports going out of scope leaks the storage it points to.) --- .../CONTROL_MODULES/MAC/flexran_agent_mac.c | 38 +++++++++++++++---- 1 file changed, 31 insertions(+), 7 deletions(-) diff --git a/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac.c b/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac.c index 656cedfe62..7bdeaaec12 100644 --- a/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac.c +++ b/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac.c @@ -192,8 +192,14 @@ int flexran_agent_mac_stats_reply(mid_t mod_id, for (j = 0; j < dl_report->n_csi_report; j++) { csi_reports[j] = malloc(sizeof(Protocol__FlexDlCsi)); - if (csi_reports[j] == NULL) + if (csi_reports[j] == NULL) { + for (k = 0; k < j; k++) { + free(csi_reports[k]); + } + free(csi_reports); + csi_reports = NULL; goto error; + } protocol__flex_dl_csi__init(csi_reports[j]); //The servCellIndex for this report csi_reports[j]->serv_cell_index = j; @@ -213,8 +219,14 @@ int flexran_agent_mac_stats_reply(mid_t mod_id, Protocol__FlexCsiP10 *csi10; csi10 = malloc(sizeof(Protocol__FlexCsiP10)); - if (csi10 == NULL) - goto error; + if (csi10 == NULL) { + for (k = 0; k <= j; k++) { + free(csi_reports[k]); + } + free(csi_reports); + csi_reports = NULL; + goto error; + } protocol__flex_csi_p10__init(csi10); //TODO: set the wideband value // NN: this is also depends on cc_id @@ -229,8 +241,14 @@ int flexran_agent_mac_stats_reply(mid_t mod_id, Protocol__FlexCsiP11 *csi11; csi11 = malloc(sizeof(Protocol__FlexCsiP11)); - if (csi11 == NULL) - goto error; + if (csi11 == NULL) { + for (k = 0; k <= j; k++) { + free(csi_reports[k]); + } + free(csi_reports); + csi_reports = NULL; + goto error; + } protocol__flex_csi_p11__init(csi11); csi11->wb_cqi = malloc(sizeof(csi11->wb_cqi)); @@ -274,8 +292,14 @@ int flexran_agent_mac_stats_reply(mid_t mod_id, Protocol__FlexCsiP20 *csi20; csi20 = malloc(sizeof(Protocol__FlexCsiP20)); - if (csi20 == NULL) - goto error; + if (csi20 == NULL) { + for (k = 0; k <= j; k++) { + free(csi_reports[k]); + } + free(csi_reports); + csi_reports = NULL; + goto error; + } protocol__flex_csi_p20__init(csi20); csi20->wb_cqi = flexran_get_ue_wcqi (enb_id, UE_id); From ca1e83187fcb58fe00e5609f6df694586d492bde Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:02:10 +0900 Subject: [PATCH 12/86] Fix Coverity Scan CID 300377 (Variable p_info going out of scope leaks the storage it points to.) --- openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac.c b/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac.c index 7bdeaaec12..45ac61a927 100644 --- a/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac.c +++ b/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac.c @@ -441,7 +441,12 @@ int flexran_agent_mac_stats_reply(mid_t mod_id, for (j = 0; j < paging_report->n_paging_info; j++) { p_info[j] = malloc(sizeof(Protocol__FlexPagingInfo)); - if(p_info[j] == NULL){ + if (p_info[j] == NULL) { + for (k = 0; k < j; k++) { + free(p_info[k]); + } + free(p_info); + p_info = NULL; free(paging_report); goto error; } From c65e3d2eea2a5fb6346f004d028949322efc75d3 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:03:41 +0900 Subject: [PATCH 13/86] Fix Coverity Scan CID 300371 (Overrunning array rb_table of 34 bytes at byte offset 255 using index rb_table_index (which evaluates to 255).) --- openair2/LAYER2/MAC/eNB_scheduler_fairRR.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/openair2/LAYER2/MAC/eNB_scheduler_fairRR.c b/openair2/LAYER2/MAC/eNB_scheduler_fairRR.c index 2626a04664..4c2e0b46a2 100644 --- a/openair2/LAYER2/MAC/eNB_scheduler_fairRR.c +++ b/openair2/LAYER2/MAC/eNB_scheduler_fairRR.c @@ -3014,8 +3014,9 @@ void schedule_ulsch_rnti_fairRR(module_id_t module_idP, UE_list->eNB_UE_stats[CC_id][UE_id].ulsch_TBS=UE_template->TBS_UL[harq_pid]; if (mac_eNB_get_rrc_status(module_idP,rnti) < RRC_CONNECTED) - LOG_D(MAC,"[eNB %d][PUSCH %d/%x] CC_id %d Frame %d subframeP %d Scheduled UE %d (mcs %d, first rb %d, nb_rb %d, rb_table_index %d, TBS %d, harq_pid %d)\n", - module_idP,harq_pid,rnti,CC_id,frameP,subframeP,UE_id,mcs_rv,first_rb[CC_id],rb_table[rb_table_index],rb_table_index,UE_template->TBS_UL[harq_pid],harq_pid); + LOG_D(MAC,"[eNB %d][PUSCH %d/%x] CC_id %d Frame %d subframeP %d Scheduled UE %d (mcs %d, first rb %d, nb_rb %d, TBS %d, harq_pid %d)\n", + module_idP,harq_pid,rnti,CC_id,frameP,subframeP,UE_id,mcs_rv,first_rb[CC_id],ulsch_ue_select[CC_id].list[ulsch_ue_num].nb_rb,UE_template->TBS_UL[harq_pid],harq_pid); + // bad indices : 20 (40 PRB), 21 (45 PRB), 22 (48 PRB) //store for possible retransmission From 864e5df407fc5e9ccbac9fd4623f26bd43d6a3b6 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:04:43 +0900 Subject: [PATCH 14/86] Fix Coverity Scan CID 300370 (Variable reconf_param going out of scope leaks the storage it points to.) --- openair2/ENB_APP/flexran_agent_common.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair2/ENB_APP/flexran_agent_common.c b/openair2/ENB_APP/flexran_agent_common.c index 16f74ccd2f..5cbcee370a 100644 --- a/openair2/ENB_APP/flexran_agent_common.c +++ b/openair2/ENB_APP/flexran_agent_common.c @@ -818,6 +818,8 @@ int flexran_agent_rrc_measurement(mid_t mod_id, const void *params, Protocol__Fl flexran_rrc_eNB_generate_defaultRRCConnectionReconfiguration(&ctxt, ue_context_p, 0, reconf_param); } *msg = NULL; + free(reconf_param); + reconf_param = NULL; return 0; } From 0e23059320aee81a819901341cf1298917e3a0b3 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:05:52 +0900 Subject: [PATCH 15/86] Fix Coverity Scan CID 261663 (Overrunning array reestablish_rnti_map of 16 4-byte elements at element index 16 (byte offset 64) using index i (which evaluates to 16).) --- openair2/RRC/LTE/rrc_eNB.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index 7b70c9564e..62ed75553a 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -6919,13 +6919,12 @@ rrc_eNB_decode_dcch( // clear currentC-RNTI from map reestablish_rnti_map[i][0] = 0; reestablish_rnti_map[i][1] = 0; + LOG_D(RRC, "reestablish_rnti_map[%d] [0] %x, [1] %x\n", + i, reestablish_rnti_map[i][0], reestablish_rnti_map[i][1]); break; } } - LOG_D(RRC, "reestablish_rnti_map[%d] [0] %x, [1] %x\n", - i, reestablish_rnti_map[i][0], reestablish_rnti_map[i][1]); - if (!ue_context_p) { LOG_E(RRC, PROTOCOL_RRC_CTXT_UE_FMT" LTE_RRCConnectionReestablishmentComplete without UE context, falt\n", From f71a53e82debbe6d79a1daf6639e317b8dc1fece Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:07:03 +0900 Subject: [PATCH 16/86] Fix Coverity Scan CID 261649 (Variable rx_buffer going out of scope leaks the storage it points to.) --- openair1/PHY/LTE_TRANSPORT/if5_tools.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair1/PHY/LTE_TRANSPORT/if5_tools.c b/openair1/PHY/LTE_TRANSPORT/if5_tools.c index 77f060a433..721d44aab4 100644 --- a/openair1/PHY/LTE_TRANSPORT/if5_tools.c +++ b/openair1/PHY/LTE_TRANSPORT/if5_tools.c @@ -606,7 +606,7 @@ void recv_IF5(RU_t *ru, openair0_timestamp *proc_timestamp, int subframe, uint16 } } #endif - + free(rx_buffer); } From 3f327f8650ea7199876c43841c57bb48c148e2be Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:09:05 +0900 Subject: [PATCH 17/86] Fix Coverity Scan CID 261637 (Using uninitialized value timestamp[0].) --- openair1/PHY/LTE_TRANSPORT/if5_tools.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair1/PHY/LTE_TRANSPORT/if5_tools.c b/openair1/PHY/LTE_TRANSPORT/if5_tools.c index 721d44aab4..830d9d1d52 100644 --- a/openair1/PHY/LTE_TRANSPORT/if5_tools.c +++ b/openair1/PHY/LTE_TRANSPORT/if5_tools.c @@ -327,6 +327,7 @@ void recv_IF5(RU_t *ru, openair0_timestamp *proc_timestamp, int subframe, uint16 uint16_t *j = NULL; openair0_timestamp timestamp[spsf / spp_eth]; + memset(timestamp, 0, sizeof(timestamp)); eth_state_t *eth = (eth_state_t*) (ru->ifdevice.priv); VCD_SIGNAL_DUMPER_DUMP_FUNCTION_BY_NAME( VCD_SIGNAL_DUMPER_FUNCTIONS_RECV_IF5, 1 ); From 0d7fa51405821dc671e4294d719a4668d55e02b7 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:09:57 +0900 Subject: [PATCH 18/86] Fix Coverity Scan CID 261633 (Overrunning array reestablish_rnti_map of 16 4-byte elements at element index 16 (byte offset 64) using index i (which evaluates to 16).) --- openair2/RRC/LTE/rrc_eNB.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index 62ed75553a..9676ddaa72 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -6275,12 +6275,12 @@ rrc_eNB_decode_ccch( if (reestablish_rnti_map[i][0] == 0) { reestablish_rnti_map[i][0] = ctxt_pP->rnti; reestablish_rnti_map[i][1] = c_rnti; + LOG_D(RRC, "reestablish_rnti_map[%d] [0] %x, [1] %x\n", + i, reestablish_rnti_map[i][0], reestablish_rnti_map[i][1]); break; } } - LOG_D(RRC, "reestablish_rnti_map[%d] [0] %x, [1] %x\n", - i, reestablish_rnti_map[i][0], reestablish_rnti_map[i][1]); ue_context_p->ue_context.reestablishment_cause = rrcConnectionReestablishmentRequest->reestablishmentCause; LOG_D(RRC, PROTOCOL_RRC_CTXT_UE_FMT" Accept connection reestablishment request from UE physCellId %ld cause %ld\n", PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP), From 91dcaae3578dbc93f26adc35e5f9645fdc1cccf8 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:11:41 +0900 Subject: [PATCH 19/86] Fix Coverity Scan CID 261623 (Variable msg_p going out of scope leaks the storage it points to.) --- openair2/RRC/LTE/rrc_eNB_S1AP.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair2/RRC/LTE/rrc_eNB_S1AP.c b/openair2/RRC/LTE/rrc_eNB_S1AP.c index ddcd6983c8..c58ebef494 100644 --- a/openair2/RRC/LTE/rrc_eNB_S1AP.c +++ b/openair2/RRC/LTE/rrc_eNB_S1AP.c @@ -1634,6 +1634,8 @@ int rrc_eNB_send_S1AP_E_RAB_MODIFY_RESP(const protocol_ctxt_t *const ctxt_pP, S1AP_E_RAB_MODIFY_RESP (msg_p).eNB_ue_s1ap_id, e_rabs_done, e_rabs_failed); itti_send_msg_to_task (TASK_S1AP, ctxt_pP->instance, msg_p); + } else { + itti_free (ITTI_MSG_ORIGIN_ID(msg_p), msg_p); } return 0; From 39e3769e9a1b7f7f5ca1fbeb2f392d883e7f116c Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:12:44 +0900 Subject: [PATCH 20/86] Fix Coverity Scan CID 261570 (Overwriting DRB_config in DRB_config = calloc(1UL, 96UL) leaks the storage that DRB_config points to.) --- openair2/RRC/LTE/rrc_eNB.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index 9676ddaa72..33c66461ca 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -2255,6 +2255,12 @@ rrc_eNB_generate_dedicatedRRCConnectionReconfiguration(const protocol_ctxt_t *co ue_context_pP->ue_context.e_rab[i].status = E_RAB_STATUS_FAILED; ue_context_pP->ue_context.e_rab[i].xid = xid; e_rab_done++; + free(DRB_pdcp_config->discardTimer); + free(DRB_pdcp_config); + free(DRB_rlc_config); + free(DRB_config->logicalChannelIdentity); + free(DRB_config->eps_BearerIdentity); + free(DRB_config); continue; } From 6c99431942d4a542461c05222c99830bfa69225a Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:13:37 +0900 Subject: [PATCH 21/86] Fix Coverity Scan CID 261563 (Overrunning array ue_context_p->ue_context.enb_gtp_ebi of 11 2-byte elements at element index 13 (byte offset 26) using index i (which evaluates to 13).) --- openair2/COMMON/s1ap_messages_types.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/openair2/COMMON/s1ap_messages_types.h b/openair2/COMMON/s1ap_messages_types.h index 2ea8237184..2615494d3b 100644 --- a/openair2/COMMON/s1ap_messages_types.h +++ b/openair2/COMMON/s1ap_messages_types.h @@ -22,6 +22,7 @@ #ifndef S1AP_MESSAGES_TYPES_H_ #define S1AP_MESSAGES_TYPES_H_ +#include "LTE_asn_constant.h" //-------------------------------------------------------------------------------------------// // Defines to access message fields. @@ -62,7 +63,7 @@ /* Maximum number of e-rabs to be setup/deleted in a single message. * Even if only one bearer will be modified by message. */ -#define S1AP_MAX_E_RAB 11 +#define S1AP_MAX_E_RAB (LTE_maxDRB + 3) /* Length of the transport layer address string * 160 bits / 8 bits by char. From 1e14bee4f39ecfed97653436e8ea562e86d91b2d Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:15:26 +0900 Subject: [PATCH 22/86] Fix Coverity Scan CID 261548 (Overrunning array eutra_bandtable of 48 24-byte elements at element index 48 (byte offset 1152) using index i (which evaluates to 48).) --- openair2/LAYER2/MAC/config.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/openair2/LAYER2/MAC/config.c b/openair2/LAYER2/MAC/config.c index 669f3cf1fe..102d273e04 100644 --- a/openair2/LAYER2/MAC/config.c +++ b/openair2/LAYER2/MAC/config.c @@ -205,6 +205,8 @@ uint32_t from_earfcn(int eutra_bandP, uint32_t dl_earfcn) { for (i = 0; i < BANDTABLE_SIZE && eutra_bandtable[i].band != eutra_bandP; i++); + AssertFatal(i < BANDTABLE_SIZE, "i %d >= BANDTABLE_SIZE %ld\n", i, BANDTABLE_SIZE); + return (eutra_bandtable[i].dl_min + (dl_earfcn - (eutra_bandtable[i].N_OFFs_DL / 10))) * 100000; } @@ -1283,4 +1285,4 @@ void eNB_Config_Local_DRX( LOG_E(MAC, "Error in local DRX configuration, the drx retransmission timer value specified is unknown\n"); break; } -} \ No newline at end of file +} From dbcfda529d10888d07b320dd49cc70f019ae30f6 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:17:33 +0900 Subject: [PATCH 23/86] Fix Coverity Scan CID 261543 (Overrunning array usim_data->usim_sqn_data.sqn_ms of 6 bytes at byte offset 6 using index 6 - i (which evaluates to 6).) --- openair3/NAS/UE/API/USIM/usim_api.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/openair3/NAS/UE/API/USIM/usim_api.c b/openair3/NAS/UE/API/USIM/usim_api.c index d8a3807ab3..7eb23be254 100644 --- a/openair3/NAS/UE/API/USIM/usim_api.c +++ b/openair3/NAS/UE/API/USIM/usim_api.c @@ -268,9 +268,9 @@ int usim_api_authenticate_test(usim_data_t *usim_data, printf("usim_data->usim_sqn_data.sqn_ms %p\n", usim_data->usim_sqn_data.sqn_ms); for (i = 0; i < USIM_API_SQNMS_SIZE; i++) { //#warning "LG:BUG HERE TODO" - printf("i %d: ((uint8_t*)(usim_data->usim_sqn_data.sqn_ms))[USIM_API_SQNMS_SIZE - i] %d\n",i, ((uint8_t*)(usim_data->usim_sqn_data.sqn_ms))[USIM_API_SQNMS_SIZE - i]); - sqn_ms[USIM_API_SQNMS_SIZE - i] = - ((uint8_t*)(usim_data->usim_sqn_data.sqn_ms))[USIM_API_SQNMS_SIZE - i]; + printf("i %d: ((uint8_t*)(usim_data->usim_sqn_data.sqn_ms))[USIM_API_SQNMS_SIZE - 1 - i] %d\n",i, ((uint8_t*)(usim_data->usim_sqn_data.sqn_ms))[USIM_API_SQNMS_SIZE - 1 - i]); + sqn_ms[USIM_API_SQNMS_SIZE - 1 - i] = + ((uint8_t*)(usim_data->usim_sqn_data.sqn_ms))[USIM_API_SQNMS_SIZE - 1 - i]; } u8 sqnms[USIM_API_SQNMS_SIZE]; From a907b35001d89bfca0401f493ac180a69f8e050a Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:18:58 +0900 Subject: [PATCH 24/86] Fix Coverity Scan CID 261519 (Using uninitialized value tmp. Field tmp.elems is uninitialized when calling _mm256_insert_epi16.) --- openair1/PHY/CODING/3gpplte_turbo_decoder_avx2_16bit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair1/PHY/CODING/3gpplte_turbo_decoder_avx2_16bit.c b/openair1/PHY/CODING/3gpplte_turbo_decoder_avx2_16bit.c index 8c2513b702..dc160817db 100644 --- a/openair1/PHY/CODING/3gpplte_turbo_decoder_avx2_16bit.c +++ b/openair1/PHY/CODING/3gpplte_turbo_decoder_avx2_16bit.c @@ -933,7 +933,7 @@ unsigned char phy_threegpplte_turbo_decoder16avx2(int16_t *y, uint32_t db; - __m256i tmp, zeros=_mm256_setzero_si256(); + __m256i tmp=_mm256_setzero_si256(), zeros=_mm256_setzero_si256(); int offset8_flag=0; From ab06b524865b12e4d5910427fe928ce9c7f9adca Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:21:07 +0900 Subject: [PATCH 25/86] Fix Coverity Scan CID 261506 (Overrunning array eutra_bandtable of 48 24-byte elements at element index 48 (byte offset 1152) using index i (which evaluates to 48).) --- openair2/LAYER2/MAC/config.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair2/LAYER2/MAC/config.c b/openair2/LAYER2/MAC/config.c index 102d273e04..d1681a632d 100644 --- a/openair2/LAYER2/MAC/config.c +++ b/openair2/LAYER2/MAC/config.c @@ -144,6 +144,8 @@ uint32_t to_earfcn(int eutra_bandP, uint32_t dl_CarrierFreq, uint32_t bw) { for (i = 0; i < BANDTABLE_SIZE && eutra_bandtable[i].band != eutra_bandP; i++); + AssertFatal(i < BANDTABLE_SIZE, "i %d >= BANDTABLE_SIZE %ld\n", i, BANDTABLE_SIZE); + AssertFatal(dl_CarrierFreq_by_100k >= eutra_bandtable[i].dl_min, "Band %d, bw %u : DL carrier frequency %u Hz < %u\n", eutra_bandP, bw, dl_CarrierFreq, From ac6f5dceb0fb7ab3015d2ee34c7f4ef56d433500 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:28:22 +0900 Subject: [PATCH 26/86] Fix Coverity Scan CID 261499 (Overrunning array sqn_ms of 6 bytes at byte offset 6 using index 6 - i (which evaluates to 6).) --- openair3/NAS/UE/API/USIM/usim_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair3/NAS/UE/API/USIM/usim_api.c b/openair3/NAS/UE/API/USIM/usim_api.c index 7eb23be254..b882689f9b 100644 --- a/openair3/NAS/UE/API/USIM/usim_api.c +++ b/openair3/NAS/UE/API/USIM/usim_api.c @@ -409,7 +409,7 @@ int usim_api_authenticate(usim_data_t *usim_data, const OctetString* rand_pP, co //#define USIM_API_SQN_MS_SIZE 3 printf("usim_data->usim_sqn.sqn_ms %p\n",usim_data->usim_sqn_data.sqn_ms); - for (i = 0; i < USIM_API_SQNMS_SIZE; i++) { + for (i = 1; i <= USIM_API_SQNMS_SIZE; i++) { //#warning "LG:BUG HERE TODO" printf("i %d: ((uint8_t*)(usim_data->usim_sqn_data.sqn_ms))[USIM_API_SQNMS_SIZE - i] %d\n",i, ((uint8_t*)(usim_data->usim_sqn_data.sqn_ms))[USIM_API_SQNMS_SIZE - i]); sqn_ms[USIM_API_SQNMS_SIZE - i] = From 00c10b77062c6decd39ad263f6d5a6052fed0bea Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:31:42 +0900 Subject: [PATCH 27/86] Fix Coverity Scan CID 261498 (Overrunning array eutra_bandtable of 48 24-byte elements at element index 48 (byte offset 1152) using index i (which evaluates to 48).) --- openair2/LAYER2/MAC/config.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair2/LAYER2/MAC/config.c b/openair2/LAYER2/MAC/config.c index d1681a632d..dd2cc205ba 100644 --- a/openair2/LAYER2/MAC/config.c +++ b/openair2/LAYER2/MAC/config.c @@ -219,6 +219,8 @@ int32_t get_uldl_offset(int eutra_bandP) { for (i = 0; i < BANDTABLE_SIZE && eutra_bandtable[i].band != eutra_bandP; i++); + AssertFatal(i < BANDTABLE_SIZE, "i %d >= BANDTABLE_SIZE %ld\n", i, BANDTABLE_SIZE); + return (eutra_bandtable[i].dl_min - eutra_bandtable[i].ul_min); } From 5fbea5caf184bd3c7784d3a4567b7cd5d2f0955c Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:34:46 +0900 Subject: [PATCH 28/86] Fix Coverity Scan CID 261489 (Overrunning array cc->mbsfn_SubframeConfig of 8 8-byte elements at element index 65535 (byte offset 524280) using index j (which evaluates to 65535).) --- openair2/LAYER2/MAC/eNB_scheduler_mch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/LAYER2/MAC/eNB_scheduler_mch.c b/openair2/LAYER2/MAC/eNB_scheduler_mch.c index faf36026d6..cf358752e8 100644 --- a/openair2/LAYER2/MAC/eNB_scheduler_mch.c +++ b/openair2/LAYER2/MAC/eNB_scheduler_mch.c @@ -65,7 +65,7 @@ get_mbsfn_sf_alloction(module_id_t module_idP, uint8_t CC_id, uint8_t mbsfn_sync_area) { // currently there is one-to-one mapping between sf allocation pattern and sync area - if (mbsfn_sync_area > MAX_MBSFN_AREA) { + if (mbsfn_sync_area >= MAX_MBSFN_AREA) { LOG_W(MAC, "[eNB %d] CC_id %d MBSFN synchronization area %d out of range\n ", module_idP, CC_id, mbsfn_sync_area); From 325e6e525c78f90eef70ab066d58cb259bf9e2b6 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:35:46 +0900 Subject: [PATCH 29/86] Fix Coverity Scan CID 261481 (Overwriting message_p in message_p = NULL leaks the storage that message_p points to.) --- openair3/S1AP/s1ap_eNB_handlers.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair3/S1AP/s1ap_eNB_handlers.c b/openair3/S1AP/s1ap_eNB_handlers.c index 18c6d98601..d5436df9fc 100644 --- a/openair3/S1AP/s1ap_eNB_handlers.c +++ b/openair3/S1AP/s1ap_eNB_handlers.c @@ -1342,6 +1342,7 @@ int s1ap_eNB_handle_e_rab_modify_request(uint32_t assoc_id, S1AP_E_RAB_MODIFY_RESP(message_p).nb_of_e_rabs_failed = nb_of_e_rabs_failed; s1ap_eNB_e_rab_modify_resp(mme_desc_p->s1ap_eNB_instance->instance, &S1AP_E_RAB_MODIFY_RESP(message_p)); + itti_free(TASK_RRC_ENB,message_p); message_p = NULL; return -1; } From 5388598f805bf8f6e7c235bc16d42801ca103ae1 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 11:44:47 +0900 Subject: [PATCH 30/86] Fix Coverity Scan CID 261470 (Using uninitialized value tmp. Field tmp.elems is uninitialized when calling _mm256_insert_epi8.) --- openair1/PHY/CODING/3gpplte_sse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair1/PHY/CODING/3gpplte_sse.c b/openair1/PHY/CODING/3gpplte_sse.c index 2a7b789650..2a51824ca4 100644 --- a/openair1/PHY/CODING/3gpplte_sse.c +++ b/openair1/PHY/CODING/3gpplte_sse.c @@ -378,7 +378,7 @@ char interleave_compact_byte(short *base_interleaver,unsigned char *input, unsig __m128i tmp; uint16_t *systematic2_ptr=(uint16_t *) output; #else - __m256i tmp; + __m256i tmp = _mm256_setzero_si256(); uint32_t *systematic2_ptr=(uint32_t *) output; #endif #elif defined(__arm__) From 6986cbdd2a9d467ce5ba02dec6da6c1fae9252fb Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:00:10 +0900 Subject: [PATCH 31/86] Fix Coverity Scan CID 261468 (Using variable UE_id as an index to array UE_list->UE_sched_ctrl.) --- openair2/LAYER2/MAC/pre_processor.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair2/LAYER2/MAC/pre_processor.c b/openair2/LAYER2/MAC/pre_processor.c index f68db9ffec..99b7437c0d 100644 --- a/openair2/LAYER2/MAC/pre_processor.c +++ b/openair2/LAYER2/MAC/pre_processor.c @@ -280,6 +280,8 @@ maxround(module_id_t Mod_id, uint16_t rnti, int frame, for (CC_id = 0; CC_id < RC.nb_mac_CC[Mod_id]; CC_id++) { cc = &RC.mac[Mod_id]->common_channels[CC_id]; UE_id = find_UE_id(Mod_id, rnti); + if(UE_id == -1) + continue; harq_pid = frame_subframe2_dl_harq_pid(cc->tdd_Config,frame,subframe); round = UE_list->UE_sched_ctrl[UE_id].round[CC_id][harq_pid]; From 8fe94b2f2ce37717158d0b0dea96649e5ceec3b0 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:00:51 +0900 Subject: [PATCH 32/86] Fix Coverity Scan CID 261458 (Variable message_p going out of scope leaks the storage it points to.) --- openair3/S1AP/s1ap_eNB_handlers.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair3/S1AP/s1ap_eNB_handlers.c b/openair3/S1AP/s1ap_eNB_handlers.c index d5436df9fc..22501bf9a5 100644 --- a/openair3/S1AP/s1ap_eNB_handlers.c +++ b/openair3/S1AP/s1ap_eNB_handlers.c @@ -1212,6 +1212,7 @@ int s1ap_eNB_handle_paging(uint32_t assoc_id, } else { /* invalid paging_p->cnDomain */ S1AP_ERROR("[SCTP %d] Received Paging : cnDomain(%ld) is unknown\n", assoc_id, ie->value.choice.CNDomain); + itti_free (ITTI_MSG_ORIGIN_ID(message_p), message_p); return -1; } } else { From 88042616cd01e778ee81be2fffcbe78b89b3882f Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:01:46 +0900 Subject: [PATCH 33/86] Fix Coverity Scan CID 140733 (Calling strncpy with a maximum size argument of 16 bytes on destination array ifr.ifr_ifrn.ifrn_name of size 16 bytes might leave the destination string unterminated.) --- openair1/SIMULATION/ETH_TRANSPORT/netlink_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair1/SIMULATION/ETH_TRANSPORT/netlink_init.c b/openair1/SIMULATION/ETH_TRANSPORT/netlink_init.c index df9114336f..396c76f8e6 100644 --- a/openair1/SIMULATION/ETH_TRANSPORT/netlink_init.c +++ b/openair1/SIMULATION/ETH_TRANSPORT/netlink_init.c @@ -81,7 +81,7 @@ static int tun_alloc(char *dev) { ifr.ifr_flags = IFF_TUN | IFF_NO_PI; if( *dev ) - strncpy(ifr.ifr_name, dev, IFNAMSIZ); + strncpy(ifr.ifr_name, dev, sizeof(ifr.ifr_name)-1); if( (err = ioctl(fd, TUNSETIFF, (void *) &ifr)) < 0 ) { close(fd); From c4d56a9331284c166d711ed15e46a80f556ed491 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:02:32 +0900 Subject: [PATCH 34/86] Fix Coverity Scan CID 60471 (Function memory_read does not terminate string *user->nas_user_nvdata.) --- openair3/NAS/UE/nas_user.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair3/NAS/UE/nas_user.c b/openair3/NAS/UE/nas_user.c index d3467eddd5..51f72a2ad9 100644 --- a/openair3/NAS/UE/nas_user.c +++ b/openair3/NAS/UE/nas_user.c @@ -161,6 +161,8 @@ void nas_user_initialize(nas_user_t *user, emm_indication_callback_t emm_cb, user->nas_user_nvdata = calloc_or_fail(sizeof(user_nvdata_t)); + memset(user->nas_user_nvdata, 0, sizeof(user_nvdata_t)); + /* Get UE data stored in the non-volatile memory device */ int rc = memory_read(user->user_nvdata_store, user->nas_user_nvdata, sizeof(user_nvdata_t)); if (rc != RETURNok) { From 731d10d9fa29aaa87bb43db013faf02b1fdcd2dd Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:30:49 +0900 Subject: [PATCH 35/86] Fix Coverity Scan CID 60469 (Using uninitialized value log. Field log.logMgrHandle is uninitialized when calling nwGtpv1uSetLogMgrEntity.) --- openair3/GTPV1-U/gtpv1u_eNB.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair3/GTPV1-U/gtpv1u_eNB.c b/openair3/GTPV1-U/gtpv1u_eNB.c index b04d0dbf28..d5af47a9a2 100644 --- a/openair3/GTPV1-U/gtpv1u_eNB.c +++ b/openair3/GTPV1-U/gtpv1u_eNB.c @@ -899,7 +899,7 @@ int gtpv1u_eNB_init(void) { } log.logReqCallback = gtpv1u_eNB_log_request; - + memset((void *)&(log.logMgrHandle), 0, sizeof(NwGtpv1uLogMgrHandleT)); if ((rc = nwGtpv1uSetLogMgrEntity(RC.gtpv1u_data_g->gtpv1u_stack, &log)) != NW_GTPV1U_OK) { LOG_E(GTPU, "nwGtpv1uSetLogMgrEntity: %x", rc); return -1; From 5275b4c7c64bd313b30ccc0ba5af1a3edb7b5f9e Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:31:35 +0900 Subject: [PATCH 36/86] Fix Coverity Scan CID 60435 (Using uninitialized value bid when calling esm_ebr_context_release.) --- openair3/NAS/UE/ESM/EpsBearerContextDeactivation.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair3/NAS/UE/ESM/EpsBearerContextDeactivation.c b/openair3/NAS/UE/ESM/EpsBearerContextDeactivation.c index 1a7328a81f..d6fd48535c 100644 --- a/openair3/NAS/UE/ESM/EpsBearerContextDeactivation.c +++ b/openair3/NAS/UE/ESM/EpsBearerContextDeactivation.c @@ -195,6 +195,7 @@ int esm_proc_eps_bearer_context_deactivate_request(nas_user_t *user, int ebi, in int pid, bid; int rc = RETURNok; esm_data_t *esm_data = user->esm_data; + bid = 0; LOG_TRACE(INFO, "ESM-PROC - EPS bearer context deactivation " "requested by the network (ebi=%d)", ebi); From 76fbb7c0b115c441fccab6884a54dd0099896b2f Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:32:07 +0900 Subject: [PATCH 37/86] Fix Coverity Scan CID 60430 (Using uninitialized value meas2. Field meas2.ext1 is uninitialized.) --- openair2/RRC/LTE/MESSAGES/asn1_msg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/RRC/LTE/MESSAGES/asn1_msg.c b/openair2/RRC/LTE/MESSAGES/asn1_msg.c index 9f12e99d9c..c736352575 100644 --- a/openair2/RRC/LTE/MESSAGES/asn1_msg.c +++ b/openair2/RRC/LTE/MESSAGES/asn1_msg.c @@ -4213,6 +4213,7 @@ uint8_t do_MeasurementReport(uint8_t Mod_id, uint8_t *buffer,int measid,int phy_ meas2.rsrpResult=&(rsrp_t); //&rsrp_va; meas2.rsrqResult=&(rsrq_t); + meas2.ext1 = NULL; measresulteutra2->measResult=meas2; ASN_SEQUENCE_ADD(&measResultListEUTRA2->list,measresulteutra2); measurementReport->criticalExtensions.choice.c1.choice.measurementReport_r8.measResults.measResultNeighCells->choice.measResultListEUTRA=*(measResultListEUTRA2); From 8084d6d247306762a1c611230c2335edcd2e9b83 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:32:36 +0900 Subject: [PATCH 38/86] Fix Coverity Scan CID 60413 (Using uninitialized value udp. Field udp.hUdp is uninitialized when calling nwGtpv1uSetUdpEntity.) --- openair3/GTPV1-U/gtpv1u_eNB.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair3/GTPV1-U/gtpv1u_eNB.c b/openair3/GTPV1-U/gtpv1u_eNB.c index d5af47a9a2..a2e8c5d95f 100644 --- a/openair3/GTPV1-U/gtpv1u_eNB.c +++ b/openair3/GTPV1-U/gtpv1u_eNB.c @@ -892,7 +892,7 @@ int gtpv1u_eNB_init(void) { * We provide a wrapper to UDP task. */ udp.udpDataReqCallback = gtpv1u_eNB_send_udp_msg; - + memset((void *)&(udp.hUdp), 0, sizeof(NwGtpv1uUdpHandleT)); if ((rc = nwGtpv1uSetUdpEntity(RC.gtpv1u_data_g->gtpv1u_stack, &udp)) != NW_GTPV1U_OK) { LOG_E(GTPU, "nwGtpv1uSetUdpEntity: %x", rc); return -1; From 47758322b6b6f8aa12969a321147d8bd3cda2c9e Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:33:09 +0900 Subject: [PATCH 39/86] Fix Coverity Scan CID 60394 (Using uninitialized value addr6. Field addr6.sin6_flowinfo is uninitialized when calling bind.) --- openair3/SCTP/sctp_eNB_task.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair3/SCTP/sctp_eNB_task.c b/openair3/SCTP/sctp_eNB_task.c index 4b0945f5ea..04752c0792 100644 --- a/openair3/SCTP/sctp_eNB_task.c +++ b/openair3/SCTP/sctp_eNB_task.c @@ -580,6 +580,7 @@ sctp_handle_new_association_req( addr6.sin6_family = AF_INET6; addr6.sin6_addr = in6addr_any; addr6.sin6_port = htons(sctp_new_association_req_p->port); + addr6.sin6_flowinfo = 0; if (bind(sd, (struct sockaddr*)&addr6, sizeof(addr6)) < 0) { SCTP_ERROR("Failed to bind the socket to address any (v4/v6): %s\n", From db137bf1d5f0ed9159a1ca5ce78bd5f7a11392b7 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:33:52 +0900 Subject: [PATCH 40/86] Fix Coverity Scan CID 60393 (Using uninitialized value pid when calling esm_ebr_context_release.) --- openair3/NAS/UE/ESM/EpsBearerContextDeactivation.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair3/NAS/UE/ESM/EpsBearerContextDeactivation.c b/openair3/NAS/UE/ESM/EpsBearerContextDeactivation.c index d6fd48535c..5adbae05c6 100644 --- a/openair3/NAS/UE/ESM/EpsBearerContextDeactivation.c +++ b/openair3/NAS/UE/ESM/EpsBearerContextDeactivation.c @@ -196,6 +196,7 @@ int esm_proc_eps_bearer_context_deactivate_request(nas_user_t *user, int ebi, in int rc = RETURNok; esm_data_t *esm_data = user->esm_data; bid = 0; + pid = 0; LOG_TRACE(INFO, "ESM-PROC - EPS bearer context deactivation " "requested by the network (ebi=%d)", ebi); From 65d168143fdaacf1b83f321383953a2b967d80aa Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:34:27 +0900 Subject: [PATCH 41/86] Fix Coverity Scan CID 60387 (Using uninitialized value ulp. Field ulp.hUlp is uninitialized when calling nwGtpv1uSetUlpEntity.) --- openair3/GTPV1-U/gtpv1u_eNB.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair3/GTPV1-U/gtpv1u_eNB.c b/openair3/GTPV1-U/gtpv1u_eNB.c index a2e8c5d95f..fcadb0530e 100644 --- a/openair3/GTPV1-U/gtpv1u_eNB.c +++ b/openair3/GTPV1-U/gtpv1u_eNB.c @@ -882,7 +882,7 @@ int gtpv1u_eNB_init(void) { * nw-gtpv1u stack. */ ulp.ulpReqCallback = gtpv1u_eNB_process_stack_req; - + memset((void *)&(ulp.hUlp), 0, sizeof(NwGtpv1uUlpHandleT)); if ((rc = nwGtpv1uSetUlpEntity(RC.gtpv1u_data_g->gtpv1u_stack, &ulp)) != NW_GTPV1U_OK) { LOG_E(GTPU, "nwGtpv1uSetUlpEntity: %x", rc); return -1; From 1d017a3625509b3fce334b344764dbb5465d9403 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:35:04 +0900 Subject: [PATCH 42/86] Fix Coverity Scan CID 60372 (Handle variable sd going out of scope leaks the handle.) --- openair3/SCTP/sctp_eNB_task.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/openair3/SCTP/sctp_eNB_task.c b/openair3/SCTP/sctp_eNB_task.c index 04752c0792..54d96017b4 100644 --- a/openair3/SCTP/sctp_eNB_task.c +++ b/openair3/SCTP/sctp_eNB_task.c @@ -764,6 +764,10 @@ static int sctp_create_new_listener( if (setsockopt(sd, IPPROTO_SCTP, SCTP_EVENTS, &event, sizeof(struct sctp_event_subscribe)) < 0) { SCTP_ERROR("setsockopt: %s:%d\n", strerror(errno), errno); + if (sd != -1) { + close(sd); + sd = -1; + } free(addr); return -1; } From d7f9a3578d770a9793834a2a1eff9daab09fc009 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:35:33 +0900 Subject: [PATCH 43/86] Fix Coverity Scan CID 60371 (Handle variable fd going out of scope leaks the handle.) --- openair3/NAS/COMMON/UTIL/device.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair3/NAS/COMMON/UTIL/device.c b/openair3/NAS/COMMON/UTIL/device.c index f8f1b9727b..41085f0e24 100644 --- a/openair3/NAS/COMMON/UTIL/device.c +++ b/openair3/NAS/COMMON/UTIL/device.c @@ -125,6 +125,7 @@ void* device_open(int type, const char* devpath, const char* params) if (stty_set(fd, params) != RETURNok) { device_close(devid); devid = NULL; + close(fd); } } } From 42f481b51e1d29f9b135697bf229d570d6752787 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:36:02 +0900 Subject: [PATCH 44/86] Fix Coverity Scan CID 60369 (Variable plain_msg going out of scope leaks the storage it points to.) --- openair3/NAS/UE/EMM/SAP/emm_as.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair3/NAS/UE/EMM/SAP/emm_as.c b/openair3/NAS/UE/EMM/SAP/emm_as.c index c73fed2fed..99a3763dea 100644 --- a/openair3/NAS/UE/EMM/SAP/emm_as.c +++ b/openair3/NAS/UE/EMM/SAP/emm_as.c @@ -437,6 +437,7 @@ static int _emm_as_data_ind(nas_user_t *user, const emm_as_data_t *msg, int *emm if (bytes < 0) { /* Failed to decrypt the message */ *emm_cause = EMM_CAUSE_PROTOCOL_ERROR; + free(plain_msg); LOG_FUNC_RETURN (bytes); } else if (header.protocol_discriminator == EPS_MOBILITY_MANAGEMENT_MESSAGE) { From 1338654285c6b5aded3ab17254f885f443d9628d Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:36:38 +0900 Subject: [PATCH 45/86] Fix Coverity Scan CID 60357 (Handle variable sfd going out of scope leaks the handle.) --- openair3/NAS/COMMON/UTIL/socket.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair3/NAS/COMMON/UTIL/socket.c b/openair3/NAS/COMMON/UTIL/socket.c index 8ec3227e20..25876c3e6f 100644 --- a/openair3/NAS/COMMON/UTIL/socket.c +++ b/openair3/NAS/COMMON/UTIL/socket.c @@ -221,6 +221,8 @@ void* socket_udp_open(int type, const char* host, const char* port) sid->type = type; sid->port = atoi (port); sid->fd = sfd; + } else { + close (sfd); } return sid; From 264e429f2344900fd8fc90bf229db3435bc7f080 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:37:08 +0900 Subject: [PATCH 46/86] Fix Coverity Scan CID 60351 (Variable sctp_cnx going out of scope leaks the storage it points to.) --- openair3/SCTP/sctp_eNB_task.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/openair3/SCTP/sctp_eNB_task.c b/openair3/SCTP/sctp_eNB_task.c index 54d96017b4..d8ffbe6dc9 100644 --- a/openair3/SCTP/sctp_eNB_task.c +++ b/openair3/SCTP/sctp_eNB_task.c @@ -800,11 +800,15 @@ static int sctp_create_new_listener( if (sctp_bindx(sd, addr, used_addresses, SCTP_BINDX_ADD_ADDR) != 0) { SCTP_ERROR("sctp_bindx: %s:%d\n", strerror(errno), errno); + free(sctp_cnx); + sctp_cnx = NULL; return -1; } if (listen(sd, 5) < 0) { SCTP_ERROR("listen: %s:%d\n", strerror(errno), errno); + free(sctp_cnx); + sctp_cnx = NULL; return -1; } @@ -823,6 +827,11 @@ err: sd = -1; } + if (sctp_cnx != NULL) { + free(sctp_cnx); + sctp_cnx = NULL; + } + return -1; } From 4eb0344714056a04cadb268ed6808bf0f181ad71 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:37:36 +0900 Subject: [PATCH 47/86] Fix Coverity Scan CID 60348 (Variable addr going out of scope leaks the storage it points to.) --- openair3/SCTP/sctp_eNB_task.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/openair3/SCTP/sctp_eNB_task.c b/openair3/SCTP/sctp_eNB_task.c index d8ffbe6dc9..e934888178 100644 --- a/openair3/SCTP/sctp_eNB_task.c +++ b/openair3/SCTP/sctp_eNB_task.c @@ -832,6 +832,11 @@ err: sctp_cnx = NULL; } + if (addr != NULL) { + free(addr); + addr = NULL; + } + return -1; } From 7cf75c6d50fe14d06f1a96b281a6974332dc4735 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:38:33 +0900 Subject: [PATCH 48/86] Fix Coverity Scan CID 60277 (Calling strncpy with a maximum size argument of 4096 bytes on destination array user_api_id->recv_buffer of size 4096 bytes might leave the destination string unterminated.) --- openair3/NAS/UE/API/USER/user_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair3/NAS/UE/API/USER/user_api.c b/openair3/NAS/UE/API/USER/user_api.c index b3bd976b71..4d47a4c2b3 100644 --- a/openair3/NAS/UE/API/USER/user_api.c +++ b/openair3/NAS/UE/API/USER/user_api.c @@ -276,7 +276,7 @@ int user_api_set_data(user_api_id_t *user_api_id, char *message) memset(user_api_id->recv_buffer, 0, USER_API_RECV_BUFFER_SIZE); - strncpy(user_api_id->recv_buffer, message, USER_API_RECV_BUFFER_SIZE); + strncpy(user_api_id->recv_buffer, message, USER_API_RECV_BUFFER_SIZE - 1); rbytes = strlen(user_api_id->recv_buffer); LOG_TRACE(INFO, "USR-API - %d bytes write", rbytes); From 3b96a7ac3f1778cd94bc04c9313359175b362843 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:39:06 +0900 Subject: [PATCH 49/86] Fix Coverity Scan CID 60241 (Passing &eplmn to function emm_proc_attach_accept which uses it as an array. This might corrupt or misinterpret adjacent memory locations.) --- openair3/NAS/UE/EMM/SAP/emm_recv.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/openair3/NAS/UE/EMM/SAP/emm_recv.c b/openair3/NAS/UE/EMM/SAP/emm_recv.c index 2c901eb49b..9af13b9dae 100644 --- a/openair3/NAS/UE/EMM/SAP/emm_recv.c +++ b/openair3/NAS/UE/EMM/SAP/emm_recv.c @@ -211,21 +211,21 @@ int emm_recv_attach_accept(nas_user_t *user, attach_accept_msg *msg, int *emm_ca /* Get the list of equivalent PLMNs */ int n_eplmns = 0; - plmn_t eplmn; + plmn_t eplmn[1]; if (msg->presencemask & ATTACH_ACCEPT_EQUIVALENT_PLMNS_PRESENT) { n_eplmns = 1; - eplmn.MCCdigit1 = msg->equivalentplmns.mccdigit1; - eplmn.MCCdigit2 = msg->equivalentplmns.mccdigit2; - eplmn.MCCdigit3 = msg->equivalentplmns.mccdigit3; - eplmn.MNCdigit1 = msg->equivalentplmns.mncdigit1; - eplmn.MNCdigit2 = msg->equivalentplmns.mncdigit2; - eplmn.MNCdigit3 = msg->equivalentplmns.mncdigit3; + eplmn[0].MCCdigit1 = msg->equivalentplmns.mccdigit1; + eplmn[0].MCCdigit2 = msg->equivalentplmns.mccdigit2; + eplmn[0].MCCdigit3 = msg->equivalentplmns.mccdigit3; + eplmn[0].MNCdigit1 = msg->equivalentplmns.mncdigit1; + eplmn[0].MNCdigit2 = msg->equivalentplmns.mncdigit2; + eplmn[0].MNCdigit3 = msg->equivalentplmns.mncdigit3; } /* Execute attach procedure accepted by the network */ rc = emm_proc_attach_accept(user, T3412, T3402, T3423, n_tais, tai, pguti, - n_eplmns, &eplmn, + n_eplmns, eplmn, &msg->esmmessagecontainer.esmmessagecontainercontents); LOG_FUNC_RETURN (rc); From e84ba4fa6cbcdd264f9322ccf008dfada25b5184 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:39:34 +0900 Subject: [PATCH 50/86] Fix Coverity Scan CID 21938 (Using uninitialized value status_resp. Field status_resp.head_sdu_creation_time is uninitialized.) --- openair2/LAYER2/RLC/TM_v9.3.0/rlc_tm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/LAYER2/RLC/TM_v9.3.0/rlc_tm.c b/openair2/LAYER2/RLC/TM_v9.3.0/rlc_tm.c index dbd1469590..bdb997b12e 100644 --- a/openair2/LAYER2/RLC/TM_v9.3.0/rlc_tm.c +++ b/openair2/LAYER2/RLC/TM_v9.3.0/rlc_tm.c @@ -161,6 +161,7 @@ rlc_tm_mac_status_indication ( status_resp.buffer_occupancy_in_bytes = ((rlc_tm_entity_t *) rlc_pP)->buffer_occupancy; status_resp.buffer_occupancy_in_pdus = status_resp.buffer_occupancy_in_bytes / ((rlc_tm_entity_t *) rlc_pP)->rlc_pdu_size; status_resp.rlc_info.rlc_protocol_state = ((rlc_tm_entity_t *) rlc_pP)->protocol_state; + status_resp.head_sdu_creation_time = 0; return status_resp; } From 3c81412704062c1b4f783ff95d8aeb188b6587ef Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:40:04 +0900 Subject: [PATCH 51/86] Fix Coverity Scan CID 21929 (Using uninitialized value newtbl.num_elements when calling hashtable_insert.) --- common/utils/hashtable/hashtable.c | 1 + 1 file changed, 1 insertion(+) diff --git a/common/utils/hashtable/hashtable.c b/common/utils/hashtable/hashtable.c index 7b0fc42213..50c2ec8324 100644 --- a/common/utils/hashtable/hashtable.c +++ b/common/utils/hashtable/hashtable.c @@ -358,6 +358,7 @@ hashtable_rc_t hashtable_resize(hash_table_t *const hashtblP, const hash_size_t newtbl.size = sizeP; newtbl.hashfunc = hashtblP->hashfunc; + newtbl.num_elements = 0; if(!(newtbl.nodes=calloc(sizeP, sizeof(hash_node_t *)))) return -1; From bdd6b0fb18ce3504d038d01ed58af94765c5411c Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:40:36 +0900 Subject: [PATCH 52/86] Fix Coverity Scan CID 21911 (Using uninitialized value data_req. Field data_req.buffer_occupancy_in_pdus is uninitialized.) --- openair2/LAYER2/RLC/AM_v9.3.0/rlc_am.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/LAYER2/RLC/AM_v9.3.0/rlc_am.c b/openair2/LAYER2/RLC/AM_v9.3.0/rlc_am.c index 30173b62ff..5f6e15d281 100644 --- a/openair2/LAYER2/RLC/AM_v9.3.0/rlc_am.c +++ b/openair2/LAYER2/RLC/AM_v9.3.0/rlc_am.c @@ -811,6 +811,7 @@ rlc_am_mac_data_request ( tb_p = tb_p->next; } /* while */ } /* MESSAGE_CHART_GENERATOR && data_req.data.nb_elements > 0 */ + data_req.buffer_occupancy_in_pdus = 0; return data_req; } From 3d12d16c29395f41af727a5c5819c3ea0eb85e23 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:41:05 +0900 Subject: [PATCH 53/86] Fix Coverity Scan CID 21906 (Using uninitialized value pcfich_bt[2 * i].) --- openair1/PHY/LTE_TRANSPORT/pcfich.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair1/PHY/LTE_TRANSPORT/pcfich.c b/openair1/PHY/LTE_TRANSPORT/pcfich.c index 18a156c3fb..3646732ce3 100644 --- a/openair1/PHY/LTE_TRANSPORT/pcfich.c +++ b/openair1/PHY/LTE_TRANSPORT/pcfich.c @@ -83,6 +83,8 @@ void generate_pcfich(uint8_t num_pdcch_symbols, subframe,num_pdcch_symbols,amp,frame_parms->nb_antenna_ports_eNB,frame_parms->Ncp); #endif + memset(pcfich_bt, 0, sizeof(pcfich_bt)); + // scrambling if ((num_pdcch_symbols>0) && (num_pdcch_symbols<4)) pcfich_scrambling(frame_parms,subframe,pcfich_b[num_pdcch_symbols-1],pcfich_bt); From d415fc52ad57ed394f2c087c8b146c21bcff0147 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:41:38 +0900 Subject: [PATCH 54/86] Fix Coverity Scan CID 21843 (Using uninitialized value data_req. Field data_req.buffer_occupancy_in_pdus is uninitialized.) --- openair2/LAYER2/RLC/UM_v9.3.0/rlc_um.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/LAYER2/RLC/UM_v9.3.0/rlc_um.c b/openair2/LAYER2/RLC/UM_v9.3.0/rlc_um.c index b59a6025f5..66a544f962 100644 --- a/openair2/LAYER2/RLC/UM_v9.3.0/rlc_um.c +++ b/openair2/LAYER2/RLC/UM_v9.3.0/rlc_um.c @@ -582,6 +582,7 @@ rlc_um_mac_data_request (const protocol_ctxt_t *const ctxt_pP, void *rlc_pP,cons } /* while (tb_p != NULL) */ } /* if (data_req.data.nb_elements > 0) */ + data_req.buffer_occupancy_in_pdus = 0; return data_req; } From b7c04de9270ec5a95fe3fd14a22e5c8726391cda Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:42:05 +0900 Subject: [PATCH 55/86] Fix Coverity Scan CID 21842 (Using uninitialized value data_req. Field data_req.ue_id_type_indicator is uninitialized.) --- openair2/LAYER2/RLC/TM_v9.3.0/rlc_tm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/LAYER2/RLC/TM_v9.3.0/rlc_tm.c b/openair2/LAYER2/RLC/TM_v9.3.0/rlc_tm.c index bdb997b12e..e481550a46 100644 --- a/openair2/LAYER2/RLC/TM_v9.3.0/rlc_tm.c +++ b/openair2/LAYER2/RLC/TM_v9.3.0/rlc_tm.c @@ -186,6 +186,7 @@ rlc_tm_mac_data_request ( PROTOCOL_RLC_TM_CTXT_ARGS(ctxt_pP, rlc_p), data_req.data.nb_elements); } + data_req.ue_id_type_indicator = 0; return data_req; } From 87023eeb6a2a708412301635f9f595a947685739 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:42:42 +0900 Subject: [PATCH 56/86] Fix Coverity Scan CID 21734 (Variable Sparams going out of scope leaks the storage it points to.) --- openair2/RRC/LTE/rrc_eNB.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index 33c66461ca..5ed42fb657 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -3422,6 +3422,9 @@ void rrc_eNB_generate_defaultRRCConnectionReconfiguration(const protocol_ctxt_t size, buffer, PDCP_TRANSMISSION_MODE_CONTROL); + + free(Sparams); + Sparams = NULL; } //----------------------------------------------------------------------------- From dc8b2c1ef06932117b6b23aa2c49b6009f509c18 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:43:17 +0900 Subject: [PATCH 57/86] Fix Coverity Scan CID 21694 (Variable quantityConfig going out of scope leaks the storage it points to.) --- openair2/RRC/LTE/rrc_eNB.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index 5ed42fb657..b03a9bf459 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -3425,6 +3425,18 @@ void rrc_eNB_generate_defaultRRCConnectionReconfiguration(const protocol_ctxt_t free(Sparams); Sparams = NULL; + + free(quantityConfig->quantityConfigEUTRA->filterCoefficientRSRP); + quantityConfig->quantityConfigEUTRA->filterCoefficientRSRP = NULL; + + free(quantityConfig->quantityConfigEUTRA->filterCoefficientRSRQ); + quantityConfig->quantityConfigEUTRA->filterCoefficientRSRQ = NULL; + + free(quantityConfig->quantityConfigEUTRA); + quantityConfig->quantityConfigEUTRA = NULL; + + free(quantityConfig); + quantityConfig = NULL; } //----------------------------------------------------------------------------- From 2a8ed1a05625d83a870f28d2d6812ac472bda40f Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:43:44 +0900 Subject: [PATCH 58/86] Fix Coverity Scan CID 21666 (Variable measResultListEUTRA2 going out of scope leaks the storage it points to.) --- openair2/RRC/LTE/MESSAGES/asn1_msg.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/openair2/RRC/LTE/MESSAGES/asn1_msg.c b/openair2/RRC/LTE/MESSAGES/asn1_msg.c index c736352575..f623162605 100644 --- a/openair2/RRC/LTE/MESSAGES/asn1_msg.c +++ b/openair2/RRC/LTE/MESSAGES/asn1_msg.c @@ -4231,9 +4231,14 @@ uint8_t do_MeasurementReport(uint8_t Mod_id, uint8_t *buffer,int measid,int phy_ if(enc_rval.encoded == -1) { LOG_I(RRC, "[eNB AssertFatal]ASN1 message encoding failed (%s, %lu)!\n", enc_rval.failed_type->name, enc_rval.encoded); + free(measResultListEUTRA2); + measResultListEUTRA2 = NULL; return -1; } + free(measResultListEUTRA2); + measResultListEUTRA2 = NULL; + return((enc_rval.encoded+7)/8); } From cd31745af1ea0ad4697c1df2e2e309852e748d4e Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:53:08 +0900 Subject: [PATCH 59/86] Fix Coverity Scan CID 340290 (Variable msg_p going out of scope leaks the storage it points to.) --- openair2/RRC/LTE/rrc_eNB_S1AP.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair2/RRC/LTE/rrc_eNB_S1AP.c b/openair2/RRC/LTE/rrc_eNB_S1AP.c index c58ebef494..8bca9c1b12 100644 --- a/openair2/RRC/LTE/rrc_eNB_S1AP.c +++ b/openair2/RRC/LTE/rrc_eNB_S1AP.c @@ -2033,6 +2033,8 @@ int rrc_eNB_send_PATH_SWITCH_REQ(const protocol_ctxt_t *const ctxt_pP, S1AP_PATH_SWITCH_REQ (msg_p).eNB_ue_s1ap_id, e_rabs_done); itti_send_msg_to_task (TASK_S1AP, ctxt_pP->instance, msg_p); + } else { + itti_free(ITTI_MSG_ORIGIN_ID(msg_p), msg_p); } return 0; From 84acd4c692513c2b78cebd6921a83984bfa6e817 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:53:58 +0900 Subject: [PATCH 60/86] Fix Coverity Scan CID 340280 (Variable msg going out of scope leaks the storage it points to.) --- openair2/X2AP/x2ap_eNB_handler.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/X2AP/x2ap_eNB_handler.c b/openair2/X2AP/x2ap_eNB_handler.c index dd59791ec9..d47c3c9ab4 100644 --- a/openair2/X2AP/x2ap_eNB_handler.c +++ b/openair2/X2AP/x2ap_eNB_handler.c @@ -785,6 +785,7 @@ int x2ap_eNB_handle_handover_response (instance_t instance, if (ue_id != x2ap_find_id_from_id_source(&instance_p->id_manager, id_source)) { X2AP_WARN("incorrect/unknown X2AP IDs for UE (old ID %d new ID %d), ignoring handover response\n", id_source, id_target); + itti_free(ITTI_MSG_ORIGIN_ID(msg), msg); return 0; } From 3354bd5122a6db07fef191cef08b6c3529bba7d8 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:54:55 +0900 Subject: [PATCH 61/86] Fix Coverity Scan CID 340278 (Variable quantityConfig going out of scope leaks the storage it points to.) --- openair2/RRC/LTE/rrc_eNB.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index b03a9bf459..9836ad4923 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -5384,6 +5384,18 @@ rrc_eNB_generate_HO_RRCConnectionReconfiguration(const protocol_ctxt_t *const ct ue_context_pP->ue_context.rnti, rrc_eNB_mui, size); + + free(quantityConfig->quantityConfigEUTRA->filterCoefficientRSRQ); + quantityConfig->quantityConfigEUTRA->filterCoefficientRSRQ = NULL; + + free(quantityConfig->quantityConfigEUTRA->filterCoefficientRSRP); + quantityConfig->quantityConfigEUTRA->filterCoefficientRSRP = NULL; + + free(quantityConfig->quantityConfigEUTRA); + quantityConfig->quantityConfigEUTRA = NULL; + + free(quantityConfig); + quantityConfig = NULL; } void From 62b5911bb395ddd3b0da48c14c4cbbc48ba0eb55 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:55:32 +0900 Subject: [PATCH 62/86] Fix Coverity Scan CID 340277 (Variable gNB_CUSystemInformation going out of scope leaks the storage it points to.) --- openair2/F1AP/f1ap_cu_interface_management.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair2/F1AP/f1ap_cu_interface_management.c b/openair2/F1AP/f1ap_cu_interface_management.c index 941dc41a4d..8332bfd21d 100644 --- a/openair2/F1AP/f1ap_cu_interface_management.c +++ b/openair2/F1AP/f1ap_cu_interface_management.c @@ -370,6 +370,8 @@ int CU_send_F1_SETUP_RESPONSE(instance_t instance, cells_to_be_activated_list_itemExtIEs); cells_to_be_activated_list_item.iE_Extensions = (struct F1AP_ProtocolExtensionContainer*)&p_160P9_t; + free(gNB_CUSystemInformation); + gNB_CUSystemInformation = NULL; } /* ADD */ cells_to_be_activated_list_item_ies->value.choice.Cells_to_be_Activated_List_Item = cells_to_be_activated_list_item; From 20406a705707e8e2086b0dc9c446889eb5d9bd4a Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:56:05 +0900 Subject: [PATCH 63/86] Fix Coverity Scan CID 340268 (Passing freed pointer pdu_mem_pP as an argument to rlc_um_store_pdu_in_dar_buffer.) --- openair2/LAYER2/RLC/UM_v9.3.0/rlc_um_dar.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair2/LAYER2/RLC/UM_v9.3.0/rlc_um_dar.c b/openair2/LAYER2/RLC/UM_v9.3.0/rlc_um_dar.c index a0569b7f00..f37626ae4c 100644 --- a/openair2/LAYER2/RLC/UM_v9.3.0/rlc_um_dar.c +++ b/openair2/LAYER2/RLC/UM_v9.3.0/rlc_um_dar.c @@ -1038,6 +1038,8 @@ rlc_um_receive_process_dar ( sn = pdu_pP->b1 & 0x1F; } else { free_mem_block(pdu_mem_pP, __func__); + pdu_mem_pP = NULL; + return; } RLC_UM_MUTEX_LOCK(&rlc_pP->lock_dar_buffer, ctxt_pP, rlc_pP); From 1ad6361bd12cfd9f1b1202163da1f1b69515bb29 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:56:35 +0900 Subject: [PATCH 64/86] Fix Coverity Scan CID 340263 (Using uninitialized value DRB2LCHAN[i] when calling rrc_mac_config_req_eNB.) --- openair2/F1AP/f1ap_du_rrc_message_transfer.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/openair2/F1AP/f1ap_du_rrc_message_transfer.c b/openair2/F1AP/f1ap_du_rrc_message_transfer.c index 6ece2d53a5..14dee4431f 100644 --- a/openair2/F1AP/f1ap_du_rrc_message_transfer.c +++ b/openair2/F1AP/f1ap_du_rrc_message_transfer.c @@ -389,6 +389,9 @@ int DU_handle_DL_RRC_MESSAGE_TRANSFER(instance_t instance, LTE_SRB_ToAddModList_t *SRB_configList = rrcConnectionReconfiguration_r8->radioResourceConfigDedicated->srb_ToAddModList; LTE_DRB_ToReleaseList_t *DRB_ReleaseList = rrcConnectionReconfiguration_r8->radioResourceConfigDedicated->drb_ToReleaseList; LTE_MAC_MainConfig_t *mac_MainConfig = NULL; + for (i = 0; i< 8; i++){ + DRB2LCHAN[i] = 0; + } if (rrcConnectionReconfiguration_r8->radioResourceConfigDedicated->mac_MainConfig) mac_MainConfig = &rrcConnectionReconfiguration_r8->radioResourceConfigDedicated->mac_MainConfig->choice.explicitValue; LTE_MeasGapConfig_t *measGapConfig = NULL; From b40385aa09e4f004da67ef65d0206e284517b722 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:57:04 +0900 Subject: [PATCH 65/86] Fix Coverity Scan CID 340261 (Variable securityConfigHO going out of scope leaks the storage it points to.) --- openair2/RRC/LTE/rrc_eNB.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index 9836ad4923..ffaff51472 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -5396,6 +5396,9 @@ rrc_eNB_generate_HO_RRCConnectionReconfiguration(const protocol_ctxt_t *const ct free(quantityConfig); quantityConfig = NULL; + + free(securityConfigHO); + securityConfigHO = NULL; } void From 8e599681b017b8f0fa29d6969540a8bbf2bca45f Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:57:34 +0900 Subject: [PATCH 66/86] Fix Coverity Scan CID 340247 (Variable pc5s_header going out of scope leaks the storage it points to.) --- openair2/LAYER2/PDCP_v10.1.0/pdcp_fifo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/openair2/LAYER2/PDCP_v10.1.0/pdcp_fifo.c b/openair2/LAYER2/PDCP_v10.1.0/pdcp_fifo.c index b2a7e9ddfc..dc1799ccb6 100644 --- a/openair2/LAYER2/PDCP_v10.1.0/pdcp_fifo.c +++ b/openair2/LAYER2/PDCP_v10.1.0/pdcp_fifo.c @@ -504,7 +504,7 @@ void pdcp_fifo_read_input_sdus_frompc5s (const protocol_ctxt_t *const ctxt_pP) //int optval; int bytes_received; sidelink_pc5s_element *sl_pc5s_msg_send = NULL; - pc5s_header_t *pc5s_header; + pc5s_header_t *pc5s_header = NULL; rb_id_t rab_id = 0; //TTN for D2D (PC5S) // receive a message from ProSe App @@ -680,6 +680,10 @@ void pdcp_fifo_read_input_sdus_frompc5s (const protocol_ctxt_t *const ctxt_pP) break; } /* end of switch */ }/* end of bytes_received > 0 */ + if (pc5s_header != NULL) { + free(pc5s_header); + pc5s_header = NULL; + } } /* pdcp_fifo_read_input_sdus_frompc5s */ //----------------------------------------------------------------------------- From 6087373184eea1979d6ae97989d375263a69d7d5 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:58:08 +0900 Subject: [PATCH 67/86] Fix Coverity Scan CID 340245 (Variable Sparams going out of scope leaks the storage it points to.) --- openair2/RRC/LTE/rrc_eNB.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index ffaff51472..aaffe7f177 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -5399,6 +5399,9 @@ rrc_eNB_generate_HO_RRCConnectionReconfiguration(const protocol_ctxt_t *const ct free(securityConfigHO); securityConfigHO = NULL; + + free(Sparams); + Sparams = NULL; } void From e9267be8db55b1ef04f417e763a070e0fa1b9257 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:58:52 +0900 Subject: [PATCH 68/86] Fix Coverity Scan CID 340243 (Overrunning array of 1 bytes at byte offset 1 by dereferencing pointer ie->value.choice.UESecurityCapabilities.encryptionAlgorithms.buf + 1.) --- openair3/UTILS/conversions.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair3/UTILS/conversions.h b/openair3/UTILS/conversions.h index 71d57cc87d..b4438b1aa5 100644 --- a/openair3/UTILS/conversions.h +++ b/openair3/UTILS/conversions.h @@ -135,7 +135,7 @@ do { \ do { \ (bitstring)->size=2; \ (bitstring)->bits_unused=0; \ - (bitstring)->buf=calloc (1, sizeof (uint8_t)); \ + (bitstring)->buf=calloc (2, sizeof (uint8_t)); \ (bitstring)->buf[0] = (encralg) >> 8; \ (bitstring)->buf[1] = (encralg); \ }while(0) From bca84e8160ba86432d129e0aa4bb15977fdf8cac Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:59:21 +0900 Subject: [PATCH 69/86] Fix Coverity Scan CID 340237 (Using variable UE_id as an index to array UE_list->UE_sched_ctrl.) --- openair2/LAYER2/MAC/pre_processor.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair2/LAYER2/MAC/pre_processor.c b/openair2/LAYER2/MAC/pre_processor.c index 99b7437c0d..a162dd5bd6 100644 --- a/openair2/LAYER2/MAC/pre_processor.c +++ b/openair2/LAYER2/MAC/pre_processor.c @@ -304,6 +304,8 @@ maxround_ul(module_id_t Mod_id, uint16_t rnti, int sched_frame, for (CC_id = 0; CC_id < RC.nb_mac_CC[Mod_id]; CC_id++) { cc = &RC.mac[Mod_id]->common_channels[CC_id]; UE_id = find_UE_id(Mod_id, rnti); + if(UE_id == -1) + continue; harq_pid = subframe2harqpid(cc, sched_frame, sched_subframe); round = UE_list->UE_sched_ctrl[UE_id].round_UL[CC_id][harq_pid]; From f1fdff80a08e331d0d98f874eda0c5b86b488862 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 13:59:53 +0900 Subject: [PATCH 70/86] Fix Coverity Scan CID 340235 (Using variable UE_id_mac as an index to array RC.mac[ctxt_pP->module_id]->UE_list.UE_sched_ctrl.) --- openair2/RRC/LTE/rrc_eNB.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index aaffe7f177..9c9c1d644f 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -5536,6 +5536,10 @@ rrc_eNB_process_RRCConnectionReconfigurationComplete( if (!NODE_IS_CU(RC.rrc[ctxt_pP->module_id]->node_type)) { /* CDRX: activated if ack was expected */ int UE_id_mac = find_UE_id(ctxt_pP->module_id, ue_context_pP->ue_context.rnti); + if (UE_id_mac == -1){ + LOG_E(RRC,PROTOCOL_RRC_CTXT_UE_FMT" rrc_eNB_process_RRCConnectionReconfigurationComplete without UE_id(MAC) rnti %x, let's return\n",PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP),ue_context_pP->ue_context.rnti); + return; + } UE_sched_ctrl *UE_scheduling_control = &(RC.mac[ctxt_pP->module_id]->UE_list.UE_sched_ctrl[UE_id_mac]); if (UE_scheduling_control->cdrx_waiting_ack == TRUE) { From f6765e0633cd2e48e708c92607365379915507ab Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:00:24 +0900 Subject: [PATCH 71/86] Fix Coverity Scan CID 340232 (Variable message_p going out of scope leaks the storage it points to.) --- openair3/S1AP/s1ap_eNB_handlers.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair3/S1AP/s1ap_eNB_handlers.c b/openair3/S1AP/s1ap_eNB_handlers.c index 22501bf9a5..e2396d015f 100644 --- a/openair3/S1AP/s1ap_eNB_handlers.c +++ b/openair3/S1AP/s1ap_eNB_handlers.c @@ -1545,6 +1545,7 @@ int s1ap_eNB_handle_s1_path_switch_request_ack(uint32_t assoc_id, S1AP_ERROR("[SCTP %d] Received path switch request ack for non " "existing UE context 0x%06lx\n", assoc_id, ie->value.choice.ENB_UE_S1AP_ID); + itti_free(ITTI_MSG_ORIGIN_ID(message_p), message_p); return -1; } From 4a3f26b2cf540825313cb25bcdce5a18b74ca95f Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:01:05 +0900 Subject: [PATCH 72/86] Fix Coverity Scan CID 340228 (Handle variable s going out of scope leaks the handle.) --- openair2/UTIL/ASYNC_IF/socket_link.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/openair2/UTIL/ASYNC_IF/socket_link.c b/openair2/UTIL/ASYNC_IF/socket_link.c index 5717624930..51c5511675 100644 --- a/openair2/UTIL/ASYNC_IF/socket_link.c +++ b/openair2/UTIL/ASYNC_IF/socket_link.c @@ -218,6 +218,7 @@ error: socket_link_t *new_link_udp_client(const char *server, int port){ + int s = -1; socket_link_t *ret = NULL; ret = calloc(1, sizeof(socket_link_t)); if (ret == NULL) { @@ -227,7 +228,6 @@ socket_link_t *new_link_udp_client(const char *server, int port){ ret->socket_fd = -1; struct sockaddr_in si_other; - int s; socklen_t slen = sizeof(si_other); if ( (s=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1){ @@ -254,8 +254,12 @@ socket_link_t *new_link_udp_client(const char *server, int port){ return ret; error: if (ret != NULL) { - close(ret->socket_fd); free(ret); + ret = NULL; + } + if (s != -1) { + close(s); + s = -1; } LOG_E(MAC, "ERROR in new_link_udp_client (see above), returning NULL\n"); return NULL; From c7d2937e3555d1ad460274c1e403d12e8f3cebfd Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:01:40 +0900 Subject: [PATCH 73/86] Fix Coverity Scan CID 340221 (Variable msg going out of scope leaks the storage it points to.) --- openair2/X2AP/x2ap_eNB_handler.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openair2/X2AP/x2ap_eNB_handler.c b/openair2/X2AP/x2ap_eNB_handler.c index d47c3c9ab4..ad1cac0479 100644 --- a/openair2/X2AP/x2ap_eNB_handler.c +++ b/openair2/X2AP/x2ap_eNB_handler.c @@ -874,6 +874,7 @@ int x2ap_eNB_handle_ue_context_release (instance_t instance, if (ue_id != x2ap_find_id_from_id_source(&instance_p->id_manager, id_source)) { X2AP_WARN("incorrect/unknown X2AP IDs for UE (old ID %d new ID %d), ignoring UE context release\n", id_source, id_target); + itti_free(ITTI_MSG_ORIGIN_ID(msg), msg); return 0; } @@ -883,6 +884,7 @@ int x2ap_eNB_handle_ue_context_release (instance_t instance, id_source, x2ap_id_get_id_target(&instance_p->id_manager, ue_id), id_target); + itti_free(ITTI_MSG_ORIGIN_ID(msg), msg); return 0; } From 9b80070a596dda73942d8cb3e7de9590d4250130 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:02:11 +0900 Subject: [PATCH 74/86] Fix Coverity Scan CID 340211 (Variable message_p going out of scope leaks the storage it points to.) --- openair2/F1AP/f1ap_cu_rrc_message_transfer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/F1AP/f1ap_cu_rrc_message_transfer.c b/openair2/F1AP/f1ap_cu_rrc_message_transfer.c index f32d5c8ed0..9bd04cc5e8 100644 --- a/openair2/F1AP/f1ap_cu_rrc_message_transfer.c +++ b/openair2/F1AP/f1ap_cu_rrc_message_transfer.c @@ -143,6 +143,7 @@ int CU_handle_INITIAL_UL_RRC_MESSAGE_TRANSFER(instance_t instance, int f1ap_uid = f1ap_add_ue(&f1ap_cu_inst[rrc_inst], rrc_inst, CC_id, 0, rnti); if (f1ap_uid < 0 ) { LOG_E(F1AP, "Failed to add UE \n"); + itti_free(ITTI_MSG_ORIGIN_ID(message_p), message_p); return -1; } f1ap_cu_inst[rrc_inst].f1ap_ue[f1ap_uid].du_ue_f1ap_id = du_ue_f1ap_id; From a70288769aa13adb4d7ccee812145ea75abab3c9 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:02:45 +0900 Subject: [PATCH 75/86] Fix Coverity Scan CID 340209 (Variable message_p going out of scope leaks the storage it points to.) --- openair2/F1AP/f1ap_cu_interface_management.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/F1AP/f1ap_cu_interface_management.c b/openair2/F1AP/f1ap_cu_interface_management.c index 8332bfd21d..48c5c2de11 100644 --- a/openair2/F1AP/f1ap_cu_interface_management.c +++ b/openair2/F1AP/f1ap_cu_interface_management.c @@ -248,6 +248,7 @@ int CU_handle_F1_SETUP_REQUEST(instance_t instance, itti_send_msg_to_task(TASK_RRC_ENB, ENB_MODULE_ID_TO_INSTANCE(instance), message_p); } else { CU_send_F1_SETUP_FAILURE(instance); + itti_free(TASK_RRC_ENB,message_p); return -1; } return 0; From f3c3a1ff674bb759ab3cced42432f679dd71cf93 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:03:17 +0900 Subject: [PATCH 76/86] Fix Coverity Scan CID 340004 (Overrunning array eutra_bandtable of 48 24-byte elements at element index 48 (byte offset 1152) using index i (which evaluates to 48).) --- openair2/LAYER2/MAC/config.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/LAYER2/MAC/config.c b/openair2/LAYER2/MAC/config.c index dd2cc205ba..9f4a3192c6 100644 --- a/openair2/LAYER2/MAC/config.c +++ b/openair2/LAYER2/MAC/config.c @@ -188,6 +188,7 @@ uint32_t to_earfcn_UL(int eutra_bandP, long long int ul_CarrierFreq, uint32_t bw for (i = 0; i < BANDTABLE_SIZE && eutra_bandtable[i].band != eutra_bandP; i++); + AssertFatal(i < BANDTABLE_SIZE, "i = %d , it will trigger out-of-bounds read.\n",i); AssertFatal(ul_CarrierFreq_by_100k >= eutra_bandtable[i].ul_min, "Band %d, bw %u : UL carrier frequency %lld Hz < %u\n", eutra_bandP, bw, ul_CarrierFreq, From 21c4e256bf7211131a0e8331aca3cb3dfe64d304 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:04:05 +0900 Subject: [PATCH 77/86] Fix Coverity Scan CID 339991 (Variable msg going out of scope leaks the storage it points to.) --- targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c | 1 + 1 file changed, 1 insertion(+) diff --git a/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c b/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c index 2c8e55d14f..621e970524 100644 --- a/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c +++ b/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c @@ -501,6 +501,7 @@ int eth_set_dev_conf_raw(openair0_device *device) { perror("ETHERNET: "); exit(0); } + free(msg); return 0; } From 4fd1495be6e0758fb993aee6446eb8c68709ae4c Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:04:40 +0900 Subject: [PATCH 78/86] Fix Coverity Scan CID 339978 (Variable msg going out of scope leaks the storage it points to..) --- targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c | 1 + 1 file changed, 1 insertion(+) diff --git a/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c b/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c index 621e970524..8c4263c7ed 100644 --- a/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c +++ b/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c @@ -591,5 +591,6 @@ int eth_get_dev_conf_raw_IF4p5(openair0_device *device) { //device->openair0_cfg=(openair0_config_t *)(msg + MAC_HEADER_SIZE_BYTES); printf("[%s] binding mod to hardware address %x:%x:%x:%x:%x:%x hardware address %x:%x:%x:%x:%x:%x\n",((device->host_type == RAU_HOST) ? "RAU": "RRU"),eth->ehd.ether_shost[0],eth->ehd.ether_shost[1],eth->ehd.ether_shost[2],eth->ehd.ether_shost[3],eth->ehd.ether_shost[4],eth->ehd.ether_shost[5],eth->ehd.ether_dhost[0],eth->ehd.ether_dhost[1],eth->ehd.ether_dhost[2],eth->ehd.ether_dhost[3],eth->ehd.ether_dhost[4],eth->ehd.ether_dhost[5]); + free(msg); return 0; } From 486f1368e05f319f26b9a8fc54e3528d1f7b93a6 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:05:13 +0900 Subject: [PATCH 79/86] Fix Coverity Scan CID 339974 (Overrunning array eutra_bandtable of 48 24-byte elements at element index 48 (byte offset 1152) using index i (which evaluates to 48).) --- openair2/LAYER2/MAC/config.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/LAYER2/MAC/config.c b/openair2/LAYER2/MAC/config.c index 9f4a3192c6..9a9592e47e 100644 --- a/openair2/LAYER2/MAC/config.c +++ b/openair2/LAYER2/MAC/config.c @@ -167,6 +167,7 @@ uint32_t to_earfcn_DL(int eutra_bandP, long long int dl_CarrierFreq, uint32_t bw for (i = 0; i < BANDTABLE_SIZE && eutra_bandtable[i].band != eutra_bandP; i++); + AssertFatal(i < BANDTABLE_SIZE, "i = %d , it will trigger out-of-bounds read.\n",i); AssertFatal(dl_CarrierFreq_by_100k >= eutra_bandtable[i].dl_min, "Band %d, bw %u : DL carrier frequency %lld Hz < %u\n", eutra_bandP, bw, dl_CarrierFreq, From 61ebac43f19a5b63d0aeac2ee60ebffdb2ea5080 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:05:40 +0900 Subject: [PATCH 80/86] Fix Coverity Scan CID 339972 (Variable msg going out of scope leaks the storage it points to.) --- targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c b/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c index 8c4263c7ed..d893c66b52 100644 --- a/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c +++ b/targets/ARCH/ETHERNET/USERSPACE/LIB/eth_raw.c @@ -533,7 +533,8 @@ int eth_set_dev_conf_raw_IF4p5(openair0_device *device) { perror("ETHERNET: "); exit(0); } - + + free(msg); return 0; } From 2f2f21d2aafbd8a01d4ec08c19c7667dab96acea Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:06:04 +0900 Subject: [PATCH 81/86] Fix Coverity Scan CID 339964 (Passing &rrc_eNB_mui to function rrc_eNB_process_S1AP_DOWNLINK_NAS which uses it as an array. This might corrupt or misinterpret adjacent memory locations.) --- openair2/RRC/LTE/rrc_eNB_S1AP.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/RRC/LTE/rrc_eNB_S1AP.c b/openair2/RRC/LTE/rrc_eNB_S1AP.c index 8bca9c1b12..dabe5b1524 100644 --- a/openair2/RRC/LTE/rrc_eNB_S1AP.c +++ b/openair2/RRC/LTE/rrc_eNB_S1AP.c @@ -918,7 +918,7 @@ rrc_eNB_process_S1AP_DOWNLINK_NAS( rrc_data_req ( &ctxt, srb_id, - *rrc_eNB_mui++, + (*rrc_eNB_mui)++, SDU_CONFIRM_NO, length, buffer, From 3adb2efd8c2ccf7a3c36d55842c0b285a9b2865f Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 14:06:32 +0900 Subject: [PATCH 82/86] Fix Coverity Scan CID 339954 (Overrunning callee's array of size 16 by passing argument ue_id (which evaluates to 65535) in call to flexran_set_ue_ul_slice_idx.) --- .../ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c b/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c index 6903d18a5b..30c10940c9 100644 --- a/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c +++ b/openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c @@ -1726,6 +1726,10 @@ int apply_ue_slice_assoc_update(mid_t mod_id) int changes = 0; for (i = 0; i < n_ue_slice_assoc_updates; i++) { int ue_id = find_UE_id(mod_id, ue_slice_assoc_update[i]->rnti); + if (ue_id < 0 || ue_id > MAX_MOBILES_PER_ENB){ + LOG_E(FLEXRAN_AGENT,"UE_id %d is wrong!!\n",ue_id); + continue; + } if (ue_slice_assoc_update[i]->has_dl_slice_id) { int slice_idx = flexran_find_dl_slice(mod_id, ue_slice_assoc_update[i]->dl_slice_id); if (flexran_dl_slice_exists(mod_id, slice_idx)) { From 0e2406f0fec3a2ead1f951d46c8485a1e01c9cd2 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Fri, 21 Jun 2019 18:31:58 +0900 Subject: [PATCH 83/86] Remove Coverity Scan CID 60241 (Passing &eplmn to function emm_proc_attach_accept which uses it as an array. This might corrupt or misinterpret adjacent memory locations.) --- openair3/NAS/UE/EMM/SAP/emm_recv.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/openair3/NAS/UE/EMM/SAP/emm_recv.c b/openair3/NAS/UE/EMM/SAP/emm_recv.c index 9af13b9dae..2c901eb49b 100644 --- a/openair3/NAS/UE/EMM/SAP/emm_recv.c +++ b/openair3/NAS/UE/EMM/SAP/emm_recv.c @@ -211,21 +211,21 @@ int emm_recv_attach_accept(nas_user_t *user, attach_accept_msg *msg, int *emm_ca /* Get the list of equivalent PLMNs */ int n_eplmns = 0; - plmn_t eplmn[1]; + plmn_t eplmn; if (msg->presencemask & ATTACH_ACCEPT_EQUIVALENT_PLMNS_PRESENT) { n_eplmns = 1; - eplmn[0].MCCdigit1 = msg->equivalentplmns.mccdigit1; - eplmn[0].MCCdigit2 = msg->equivalentplmns.mccdigit2; - eplmn[0].MCCdigit3 = msg->equivalentplmns.mccdigit3; - eplmn[0].MNCdigit1 = msg->equivalentplmns.mncdigit1; - eplmn[0].MNCdigit2 = msg->equivalentplmns.mncdigit2; - eplmn[0].MNCdigit3 = msg->equivalentplmns.mncdigit3; + eplmn.MCCdigit1 = msg->equivalentplmns.mccdigit1; + eplmn.MCCdigit2 = msg->equivalentplmns.mccdigit2; + eplmn.MCCdigit3 = msg->equivalentplmns.mccdigit3; + eplmn.MNCdigit1 = msg->equivalentplmns.mncdigit1; + eplmn.MNCdigit2 = msg->equivalentplmns.mncdigit2; + eplmn.MNCdigit3 = msg->equivalentplmns.mncdigit3; } /* Execute attach procedure accepted by the network */ rc = emm_proc_attach_accept(user, T3412, T3402, T3423, n_tais, tai, pguti, - n_eplmns, eplmn, + n_eplmns, &eplmn, &msg->esmmessagecontainer.esmmessagecontainercontents); LOG_FUNC_RETURN (rc); From 4c60ee777582b79ee8ba9f893250b08c20f449b8 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Fri, 21 Jun 2019 18:34:14 +0900 Subject: [PATCH 84/86] Remove Coverity Scan CID 60471 (Function memory_read does not terminate string *user->nas_user_nvdata.) --- openair3/NAS/UE/nas_user.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/openair3/NAS/UE/nas_user.c b/openair3/NAS/UE/nas_user.c index 51f72a2ad9..d3467eddd5 100644 --- a/openair3/NAS/UE/nas_user.c +++ b/openair3/NAS/UE/nas_user.c @@ -161,8 +161,6 @@ void nas_user_initialize(nas_user_t *user, emm_indication_callback_t emm_cb, user->nas_user_nvdata = calloc_or_fail(sizeof(user_nvdata_t)); - memset(user->nas_user_nvdata, 0, sizeof(user_nvdata_t)); - /* Get UE data stored in the non-volatile memory device */ int rc = memory_read(user->user_nvdata_store, user->nas_user_nvdata, sizeof(user_nvdata_t)); if (rc != RETURNok) { From 14e6da9ab509659e04baccd323df268032915a01 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Fri, 21 Jun 2019 18:36:44 +0900 Subject: [PATCH 85/86] Remove Coverity Scan CID 261470 (Using uninitialized value tmp. Field tmp.elems is uninitialized when calling _mm256_insert_epi8.) --- openair1/PHY/CODING/3gpplte_sse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair1/PHY/CODING/3gpplte_sse.c b/openair1/PHY/CODING/3gpplte_sse.c index 2a51824ca4..2a7b789650 100644 --- a/openair1/PHY/CODING/3gpplte_sse.c +++ b/openair1/PHY/CODING/3gpplte_sse.c @@ -378,7 +378,7 @@ char interleave_compact_byte(short *base_interleaver,unsigned char *input, unsig __m128i tmp; uint16_t *systematic2_ptr=(uint16_t *) output; #else - __m256i tmp = _mm256_setzero_si256(); + __m256i tmp; uint32_t *systematic2_ptr=(uint32_t *) output; #endif #elif defined(__arm__) From 42a0f7b0168db397be516d387d9fff6390f39828 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Fri, 21 Jun 2019 18:39:47 +0900 Subject: [PATCH 86/86] Remove Coverity Scan CID 261519 (Using uninitialized value tmp. Field tmp.elems is uninitialized when calling _mm256_insert_epi16.) --- openair1/PHY/CODING/3gpplte_turbo_decoder_avx2_16bit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair1/PHY/CODING/3gpplte_turbo_decoder_avx2_16bit.c b/openair1/PHY/CODING/3gpplte_turbo_decoder_avx2_16bit.c index dc160817db..8c2513b702 100644 --- a/openair1/PHY/CODING/3gpplte_turbo_decoder_avx2_16bit.c +++ b/openair1/PHY/CODING/3gpplte_turbo_decoder_avx2_16bit.c @@ -933,7 +933,7 @@ unsigned char phy_threegpplte_turbo_decoder16avx2(int16_t *y, uint32_t db; - __m256i tmp=_mm256_setzero_si256(), zeros=_mm256_setzero_si256(); + __m256i tmp, zeros=_mm256_setzero_si256(); int offset8_flag=0;