From 915c41c127e48bd09c5905a5bc52246a60d7270c Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Tue, 23 Sep 2025 16:10:48 +0200 Subject: [PATCH] Fix MTC sequence memory leak in UE context setup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add missing ASN_STRUCT_FREE for NR_MeasurementTimingConfiguration in ue_context_setup_request - Fix 64-byte MTC sequence leak in get_nr_mtc → SEQUENCE_decode_uper AddressSanitizer backtrace: Direct leak of 64 byte(s) in 1 object(s) allocated from: /#0 0x7dcfcb8b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 /#1 0x591fcc59b67d in SEQUENCE_decode_uper /home/guido/repo/openairinterface5g/develop/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37 /#2 0x591fcc57eaa1 in uper_decode /home/guido/repo/openairinterface5g/develop/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83 /#3 0x591fcbdbedeb in get_nr_mtc /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4216 /#4 0x591fcbd58188 in ue_context_setup_request /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:635 /#5 0x591fcbb92568 in nr_initiate_handover /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:218 /#6 0x591fcbb9a37f in nr_rrc_trigger_n2_ho_target /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:526 /#7 0x591fcbaf7608 in rrc_gNB_process_e1_bearer_context_setup_resp /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:2640 /#8 0x591fcbafab7b in rrc_gnb_task /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:3019 /#9 0x7dcfca294ac2 in start_thread nptl/pthread_create.c:442 Root cause: ue_context_setup_request allocated NR_MeasurementTimingConfiguration via get_nr_mtc() but never freed it after creating the measurement gap configuration. The create_measgap_config function only reads from the structure and doesn't take ownership, so the caller must free it. --- openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c | 1 + 1 file changed, 1 insertion(+) diff --git a/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c b/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c index b3d596b524..debc0d5530 100644 --- a/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c +++ b/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c @@ -721,6 +721,7 @@ void ue_context_setup_request(const f1ap_ue_context_setup_req_t *req) /* free the memory we allocated above */ free_ue_context_setup_resp(&resp); ASN_STRUCT_FREE(asn_DEF_NR_CG_ConfigInfo, cg_configinfo); + ASN_STRUCT_FREE(asn_DEF_NR_MeasurementTimingConfiguration, mtc); } void ue_context_modification_request(const f1ap_ue_context_mod_req_t *req)