From d6047cd83dbe26997dc0a307467617b7d3bccdfc Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 3 Oct 2025 10:54:43 +0200 Subject: [PATCH] Fix memory leak in dlInformationTransfer case - Remove unnecessary NULL assignment for dedicatedNAS_Message->buf - The original buffer is copied and transfered to NAS, so it can be properly freed by ASN.1 structure cleanup Root cause: Code was nullifying dedicatedNAS_Message->buf pointer before ASN.1 cleanup could free the original allocation, causing the leak from OCTET_STRING_decode_uper. AddressSanitizer leak trace (FIXED): Direct leak of 119 byte(s) in 3 object(s) allocated from: /#0 0x7ec2a42b4c38 in __interceptor_realloc /#1 0x555fade852e0 in OCTET_STRING_decode_uper /#9 0x555fadb48b11 in nr_rrc_ue_decode_dcch. --- openair2/RRC/NR_UE/rrc_UE.c | 1 - 1 file changed, 1 deletion(-) diff --git a/openair2/RRC/NR_UE/rrc_UE.c b/openair2/RRC/NR_UE/rrc_UE.c index 217ca85be7..2801aacce7 100644 --- a/openair2/RRC/NR_UE/rrc_UE.c +++ b/openair2/RRC/NR_UE/rrc_UE.c @@ -2299,7 +2299,6 @@ static int nr_rrc_ue_decode_dcch(NR_UE_RRC_INST_t *rrc, msg->nasMsg.nas_data = malloc(msg->nasMsg.length); memcpy(msg->nasMsg.nas_data, dedicatedNAS_Message->buf, msg->nasMsg.length); itti_send_msg_to_task(TASK_NAS_NRUE, rrc->ue_id, ittiMsg); - dedicatedNAS_Message->buf = NULL; // to keep the buffer, up to NAS to free it } } } break;