From a38aa1bab8cfab44942dbc324cea220201e31c74 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Thu, 18 Sep 2025 22:02:47 +0200 Subject: [PATCH] Fix memory leaks in fill_removal_lists_from_source_measConfig - Add proper cleanup of allocated ASN.1 structures in all return paths - Fix early returns that were leaking NR_HandoverPreparationInformation - Fix early returns that were leaking NR_RRCReconfiguration - Add cleanup at end of successful function execution This prevents memory leaks when processing handover preparation information during N2 handover procedures. --- openair2/RRC/NR/MESSAGES/asn1_msg.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/openair2/RRC/NR/MESSAGES/asn1_msg.c b/openair2/RRC/NR/MESSAGES/asn1_msg.c index 0ed1750d6b..f76f3ee1d1 100644 --- a/openair2/RRC/NR/MESSAGES/asn1_msg.c +++ b/openair2/RRC/NR/MESSAGES/asn1_msg.c @@ -1231,6 +1231,7 @@ void fill_removal_lists_from_source_measConfig(NR_MeasConfig_t *currentMC, byte_ and extract the measConfig provided by the source gNB */ if (!hpi->criticalExtensions.choice.c1->choice.handoverPreparationInformation->sourceConfig) { LOG_W(NR_RRC, "Missing sourceConfig: in source gNB rrcReconfiguration\n"); + ASN_STRUCT_FREE(asn_DEF_NR_HandoverPreparationInformation, hpi); return; } NR_RRCReconfiguration_t *rrcReconf = NULL; @@ -1242,11 +1243,15 @@ void fill_removal_lists_from_source_measConfig(NR_MeasConfig_t *currentMC, byte_ sourceConfig->rrcReconfiguration.size); if (rrcReconf_dec_rval.code != RC_OK || rrcReconf_dec_rval.consumed < 0) { LOG_E(NR_RRC, "Failed to decode source gNB rrcReconfiguration!\n"); + ASN_STRUCT_FREE(asn_DEF_NR_HandoverPreparationInformation, hpi); return; } - if (rrcReconf->criticalExtensions.choice.rrcReconfiguration->measConfig == NULL) + if (rrcReconf->criticalExtensions.choice.rrcReconfiguration->measConfig == NULL) { + ASN_STRUCT_FREE(asn_DEF_NR_HandoverPreparationInformation, hpi); + ASN_STRUCT_FREE(asn_DEF_NR_RRCReconfiguration, rrcReconf); return; + } NR_MeasConfig_t *sourceMC = rrcReconf->criticalExtensions.choice.rrcReconfiguration->measConfig; @@ -1278,6 +1283,10 @@ void fill_removal_lists_from_source_measConfig(NR_MeasConfig_t *currentMC, byte_ asn1cSeqAdd(¤tMC->measIdToRemoveList->list, measId); } } + + // Clean up allocated memory + ASN_STRUCT_FREE(asn_DEF_NR_HandoverPreparationInformation, hpi); + ASN_STRUCT_FREE(asn_DEF_NR_RRCReconfiguration, rrcReconf); } int doRRCReconfiguration_from_HandoverCommand(byte_array_t *ba, const byte_array_t handoverCommand)