From ae803b5370f1bdb83bbbb0edec282e5599b36519 Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Wed, 23 Feb 2022 16:57:49 +0100 Subject: [PATCH] Prevent heap buffer overflow in nr_dlsch_channel_compensation() The TX correlation calculation incremented the pointer over the outer TX antenna inside the inner TX antenna loop. Incrementing the pointer in the outer loop instead prevents overflowing. --- openair1/PHY/NR_UE_TRANSPORT/nr_dlsch_demodulation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair1/PHY/NR_UE_TRANSPORT/nr_dlsch_demodulation.c b/openair1/PHY/NR_UE_TRANSPORT/nr_dlsch_demodulation.c index 075aaecc08..7101cadac8 100644 --- a/openair1/PHY/NR_UE_TRANSPORT/nr_dlsch_demodulation.c +++ b/openair1/PHY/NR_UE_TRANSPORT/nr_dlsch_demodulation.c @@ -1027,7 +1027,6 @@ void nr_dlsch_channel_compensation(int **rxdataF_ext, ((int16_t*)&rho128[2])[5] + ((int16_t*)&rho128[2])[7])/16; - dl_ch128+=3; dl_ch128_2+=3; rho128+=3; } @@ -1037,6 +1036,7 @@ void nr_dlsch_channel_compensation(int **rxdataF_ext, avg_rho_im[aarx][aatx*nb_aatx+atx] = 16*avg_rho_im[aarx][aatx*nb_aatx+atx]/(nb_rb*12); //printf("rho[rx]%d tx%d tx%d = Re: %d Im: %d\n",aarx, aatx,atx, avg_rho_re[aarx][aatx*nb_aatx+atx], avg_rho_im[aarx][aatx*nb_aatx+atx]); } + dl_ch128+=3; } } }