From 9f97320cbe9a26bff23fa24781715e74c0e74082 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Wed, 20 Aug 2025 19:07:06 +0200 Subject: [PATCH] HO Preparation: calloc pdcp_config in DRB to Modify Item decoding The malloced struct is initialized to garbage and when the IE is absent, the output "PDCP reestablishment" member (allocated in the stack) is set to a random value. --- openair2/E1AP/lib/e1ap_bearer_context_management.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/E1AP/lib/e1ap_bearer_context_management.c b/openair2/E1AP/lib/e1ap_bearer_context_management.c index 2c4f938a24..f9afa06f69 100644 --- a/openair2/E1AP/lib/e1ap_bearer_context_management.c +++ b/openair2/E1AP/lib/e1ap_bearer_context_management.c @@ -1658,7 +1658,7 @@ static bool e1_decode_pdu_session_to_mod_item(pdu_session_to_mod_t *out, const E drb->id = drb2Mod->dRB_ID; // PDCP Config (O) if (drb2Mod->pDCP_Configuration) { - drb->pdcp_config = malloc_or_fail(sizeof(*drb->pdcp_config)); + drb->pdcp_config = calloc_or_fail(1, sizeof(*drb->pdcp_config)); CHECK_E1AP_DEC(e1_decode_pdcp_config(drb->pdcp_config, drb2Mod->pDCP_Configuration)); } // SDAP Config (O)