Merge remote-tracking branch 'origin/kpm-ran-func-segfault' into integration_2025_w38 (!3643)

Fix memory allocation issue in KPM RAN function sd parameter handling

This fixes a segmentation fault in the gNB when a KPM xApp sends the sd
parameter in the subscription message.

The segmentation fault seems to occur because *sd is uninitialized when
malloc(**sd) is called. This causes a double dereference of an uninitialized
pointer - **sd reads a random memory value which becomes the size parameter
for malloc(), leading to unpredictable memory allocation and segfaults.

This fix allocates the size using malloc(sizeof(uint32_t)) instead of
dereferencing the uninitialized pointer.
This commit is contained in:
Jaroslava Fiedlerova
2025-09-16 12:58:55 +02:00
@@ -170,7 +170,7 @@ static void capture_sst_sd(test_cond_value_t* test_cond_value, uint8_t *sst, uin
DevAssert(test_cond_value->octet_string_value->len == 4);
uint8_t *buf = test_cond_value->octet_string_value->buf;
*sst = buf[0];
*sd = malloc(**sd);
*sd = malloc(sizeof(uint32_t));
**sd = buf[1] << 16 | buf[2] << 8 | buf[3];
}
printf("[E2 AGENT][E2SM-KPM] Condition NSSAI (%d, %x).\n", *sst, (*sd) ? **sd : 0xffffff);