From 9086fb63de1e3c0fa8ae79ccab6652f2a5ee8cfd Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 3 Oct 2025 10:38:38 +0200 Subject: [PATCH] Fix memory leak in nr_rrc_ue_process_masterCellGroup - Replace asn1cFreeStruc with ASN_STRUCT_FREE in MAC layer cleanup - Fixes improper memory management of NR_CellGroupConfig structures Root cause: asn1cFreeStruc only calls ASN_STRUCT_RESET + free(), which doesn't properly free nested ASN.1 allocations. ASN_STRUCT_FREE frees all nested structures completely. AddressSanitizer leak trace: Direct leak of 288 byte(s) in 1 object(s) allocated from: /#0 0x7fb72bab4a57 in __interceptor_calloc /#1 0x593752b28d0d in SEQUENCE_decode_uper /#2 0x593752b9a546 in SET_OF_decode_uper /#3 0x593752b2863c in SEQUENCE_decode_uper /#4 0x593752b47363 in CHOICE_decode_uper /#5 0x593752b2863c in SEQUENCE_decode_uper /#6 0x593752b2863c in SEQUENCE_decode_uper /#7 0x593752b2863c in SEQUENCE_decode_uper /#8 0x593752b2863c in SEQUENCE_decode_uper /#9 0x593752b2863c in SEQUENCE_decode_uper /#10 0x593752b38551 in uper_decode /#11 0x5937527d859f in nr_rrc_ue_process_masterCellGroup /#12 0x5937527d9408 in nr_rrc_process_reconfiguration_v1530 /#13 0x5937527dd5bb in nr_rrc_ue_process_rrcReconfiguration /#14 0x5937527f5e6b in nr_rrc_ue_decode_dcch /#15 0x5937527ff003 in rrc_nrue /#16 0x59375280c6de in rrc_nrue_task --- openair2/RRC/NR_UE/L2_interface_ue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/RRC/NR_UE/L2_interface_ue.c b/openair2/RRC/NR_UE/L2_interface_ue.c index d6bee2ab10..501510f7d2 100644 --- a/openair2/RRC/NR_UE/L2_interface_ue.c +++ b/openair2/RRC/NR_UE/L2_interface_ue.c @@ -140,7 +140,7 @@ void process_msg_rcc_to_mac(nr_mac_rrc_message_t *msg, int instance_id) break; case NR_MAC_RRC_CONFIG_CG: nr_rrc_mac_config_req_cg(instance_id, 0, msg->payload.config_cg.cellGroupConfig, msg->payload.config_cg.UE_NR_Capability); - asn1cFreeStruc(asn_DEF_NR_CellGroupConfig, msg->payload.config_cg.cellGroupConfig); + ASN_STRUCT_FREE(asn_DEF_NR_CellGroupConfig, msg->payload.config_cg.cellGroupConfig); break; case NR_MAC_RRC_CONFIG_MIB: nr_rrc_mac_config_req_mib(instance_id,