From 9639cbb436cbc8364917a87472eead4dde35969c Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 3 Oct 2025 12:33:03 +0200 Subject: [PATCH] Fix memory leak in nr_rrc_process_dedicatedNAS_MessageList The leak was caused by improper memory ownership handling in the dedicatedNAS_MessageList processing. The function was transferring buffer ownership to NAS messages and then preventing ASN.1 cleanup from freeing the original allocations by setting list.count = 0, causing a memory leak. Leak trace: Direct leak of 40 byte(s) in 1 object(s) allocated from: /#0 0x7f2ce3ab4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 /#1 0x567907083f0f in OCTET_STRING_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/OCTET_STRING_uper.c:89 /#2 0x5679070ed5e6 in SET_OF_decode_uper /cmake_targets/ran_build/build/openair2/RRC/NR/MESSAGES/constr_SET_OF_uper.c:70 /#3 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118 /#4 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118 /#5 0x56790709a403 in CHOICE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:84 /#6 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118 /#7 0x56790709a403 in CHOICE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:84 /#8 0x56790709a403 in CHOICE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:84 /#9 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118 /#10 0x56790708b5f1 in uper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83 /#11 0x567906d44b4b in nr_rrc_ue_decode_dcch /openair2/RRC/NR_UE/rrc_UE.c:2212 /#12 0x567906d520a3 in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:2615 /#13 0x567906d5f77e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:2501 /#14 0x7f2ce2494ac2 in start_thread nptl/pthread_create.c:442 Fix: - Copy OCTET_STRING data instead of transferring ownership - Allow ASN.1 cleanup to properly free original allocations This fixes the leak that occurred during rrcReconfiguration message processing when dedicatedNAS_MessageList was present. Closes #828 --- openair2/RRC/NR_UE/rrc_UE.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openair2/RRC/NR_UE/rrc_UE.c b/openair2/RRC/NR_UE/rrc_UE.c index c167982859..217ca85be7 100644 --- a/openair2/RRC/NR_UE/rrc_UE.c +++ b/openair2/RRC/NR_UE/rrc_UE.c @@ -607,10 +607,10 @@ static void nr_rrc_process_dedicatedNAS_MessageList(NR_UE_RRC_INST_t *rrc, NR_RR nas_establish_cnf_t *msg = &NAS_CONN_ESTABLI_CNF(ittiMsg); msg->errCode = AS_SUCCESS; msg->nasMsg.length = tmp->list.array[i]->size; - msg->nasMsg.nas_data = tmp->list.array[i]->buf; + msg->nasMsg.nas_data = malloc_or_fail(msg->nasMsg.length); + memcpy(msg->nasMsg.nas_data, tmp->list.array[i]->buf, msg->nasMsg.length); itti_send_msg_to_task(TASK_NAS_NRUE, rrc->ue_id, ittiMsg); } - tmp->list.count = 0; // to prevent the automatic free by ASN1_FREE } }