From d7685224664cb3d9bb7f255aa31c4c4db75e5498 Mon Sep 17 00:00:00 2001 From: Michael Cook Date: Mon, 23 Aug 2021 21:06:09 +0000 Subject: [PATCH] Be more careful about buffer sizes --- openair2/RRC/LTE/MESSAGES/asn1_msg.c | 37 +++++++++++------- openair2/RRC/LTE/MESSAGES/asn1_msg.h | 24 +++++++----- openair2/RRC/LTE/MESSAGES/asn1_msg_NB_IoT.c | 11 ++++-- openair2/RRC/LTE/MESSAGES/asn1_msg_NB_IoT.h | 8 ++-- openair2/RRC/LTE/defs_NB_IoT.h | 1 - openair2/RRC/LTE/rrc_UE.c | 4 +- openair2/RRC/LTE/rrc_defs.h | 1 - openair2/RRC/LTE/rrc_eNB.c | 43 ++++++++++++++------- openair2/RRC/LTE/rrc_eNB_S1AP.c | 2 +- openair2/RRC/LTE/rrc_proto.h | 1 + openair2/RRC/NR/MESSAGES/asn1_msg.c | 23 ++++++----- openair2/RRC/NR/MESSAGES/asn1_msg.h | 24 +++++++----- openair2/RRC/NR/nr_rrc_defs.h | 1 - openair2/RRC/NR/rrc_gNB.c | 22 ++++++----- openair2/RRC/NR_UE/rrc_UE.c | 14 +++++-- 15 files changed, 136 insertions(+), 80 deletions(-) diff --git a/openair2/RRC/LTE/MESSAGES/asn1_msg.c b/openair2/RRC/LTE/MESSAGES/asn1_msg.c index bd0ca05029..2e2b4a0300 100644 --- a/openair2/RRC/LTE/MESSAGES/asn1_msg.c +++ b/openair2/RRC/LTE/MESSAGES/asn1_msg.c @@ -2129,7 +2129,7 @@ uint8_t do_SIB23(uint8_t Mod_id, return((enc_rval.encoded+7)/8); } -uint8_t do_RRCConnectionRequest(uint8_t Mod_id, uint8_t *buffer,uint8_t *rv) { +uint8_t do_RRCConnectionRequest(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, uint8_t *rv) { asn_enc_rval_t enc_rval; uint8_t buf[5],buf2=0; LTE_UL_CCCH_Message_t ul_ccch_msg; @@ -2178,7 +2178,7 @@ uint8_t do_RRCConnectionRequest(uint8_t Mod_id, uint8_t *buffer,uint8_t *rv) { NULL, (void *)&ul_ccch_msg, buffer, - 100); + buffer_size); AssertFatal (enc_rval.encoded > 0, "ASN1 message encoding failed (%s, %lu)!\n", enc_rval.failed_type->name, enc_rval.encoded); LOG_D(RRC,"[UE] RRCConnectionRequest Encoded %zd bits (%zd bytes)\n", enc_rval.encoded, (enc_rval.encoded+7)/8); return((enc_rval.encoded+7)/8); @@ -3176,6 +3176,7 @@ uint8_t do_RRCConnectionSetup_BR( uint8_t do_SecurityModeCommand( const protocol_ctxt_t *const ctxt_pP, uint8_t *const buffer, + size_t buffer_size, const uint8_t Transaction_id, const uint8_t cipheringAlgorithm, const uint8_t integrityProtAlgorithm @@ -3205,7 +3206,7 @@ uint8_t do_SecurityModeCommand( NULL, (void *)&dl_dcch_msg, buffer, - 100); + buffer_size); if(enc_rval.encoded == -1) { LOG_I(RRC, "[eNB AssertFatal]ASN1 message encoding failed (%s, %lu)!\n", @@ -3234,6 +3235,7 @@ uint8_t do_SecurityModeCommand( //------------------------------------------------------------------------------ uint8_t do_UECapabilityEnquiry( const protocol_ctxt_t *const ctxt_pP, uint8_t *const buffer, + size_t buffer_size, const uint8_t Transaction_id, int16_t eutra_band, uint32_t nr_band) @@ -3331,7 +3333,7 @@ uint8_t do_UECapabilityEnquiry( const protocol_ctxt_t *const ctxt_pP, NULL, (void *)&dl_dcch_msg, buffer, - 100); + buffer_size); if(enc_rval.encoded == -1) { LOG_I(RRC, "[eNB AssertFatal]ASN1 message encoding failed (%s, %lu)!\n", @@ -3358,6 +3360,7 @@ uint8_t do_UECapabilityEnquiry( const protocol_ctxt_t *const ctxt_pP, //------------------------------------------------------------------------------ uint8_t do_NR_UECapabilityEnquiry( const protocol_ctxt_t *const ctxt_pP, uint8_t *const buffer, + size_t buffer_size, const uint8_t Transaction_id, int16_t eutra_band, uint32_t nr_band) @@ -3451,7 +3454,7 @@ uint8_t do_NR_UECapabilityEnquiry( const protocol_ctxt_t *const ctxt_pP, NULL, (void *)&dl_dcch_msg, buffer, - 100); + buffer_size); if(enc_rval.encoded == -1) { LOG_I(RRC, "[eNB AssertFatal]ASN1 message encoding failed (%s, %lu)!\n", @@ -3478,6 +3481,7 @@ uint8_t do_NR_UECapabilityEnquiry( const protocol_ctxt_t *const ctxt_pP, uint16_t do_RRCConnectionReconfiguration_BR(const protocol_ctxt_t *const ctxt_pP, uint8_t *buffer, + size_t buffer_size, uint8_t Transaction_id, LTE_SRB_ToAddModList_t *SRB_list, LTE_DRB_ToAddModList_t *DRB_list, @@ -3579,7 +3583,7 @@ uint16_t do_RRCConnectionReconfiguration_BR(const protocol_ctxt_t *const NULL, (void *)&dl_dcch_msg, buffer, - RRC_BUF_SIZE); + buffer_size); AssertFatal (enc_rval.encoded > 0, "ASN1 message encoding failed %s, %lu!\n", enc_rval.failed_type->name, enc_rval.encoded); if ( LOG_DEBUGFLAG(DEBUG_ASN1) ) { @@ -3596,6 +3600,7 @@ uint16_t do_RRCConnectionReconfiguration_BR(const protocol_ctxt_t *const */ uint16_t do_RRCConnectionReconfiguration(const protocol_ctxt_t *const ctxt_pP, uint8_t *buffer, + size_t buffer_size, uint8_t Transaction_id, LTE_SRB_ToAddModList_t *SRB_list, LTE_DRB_ToAddModList_t *DRB_list, @@ -3756,7 +3761,7 @@ uint16_t do_RRCConnectionReconfiguration(const protocol_ctxt_t *const ctxt_pP, NULL, (void *)&dl_dcch_msg, buffer, - RRC_BUF_SIZE); + buffer_size); if(enc_rval.encoded == -1) { LOG_I(RRC, "[eNB AssertFatal]ASN1 message encoding failed (%s, %lu)!\n", @@ -4011,6 +4016,7 @@ uint8_t do_RRCConnectionReject(uint8_t Mod_id, uint8_t do_RRCConnectionRelease(uint8_t Mod_id, uint8_t *buffer, + size_t buffer_size, uint8_t Transaction_id) { asn_enc_rval_t enc_rval; LTE_DL_DCCH_Message_t dl_dcch_msg; @@ -4032,7 +4038,7 @@ uint8_t do_RRCConnectionRelease(uint8_t Mod_id, NULL, (void *)&dl_dcch_msg, buffer, - RRC_BUF_SIZE); + buffer_size); return((enc_rval.encoded+7)/8); } @@ -4042,6 +4048,7 @@ uint8_t TMGI[5] = {4,3,2,1,0};//TMGI is a string of octet, ref. TS 24.008 fig. 1 uint8_t do_MBSFNAreaConfig(uint8_t Mod_id, uint8_t sync_area, uint8_t *buffer, + size_t buffer_size, LTE_MCCH_Message_t *mcch_message, LTE_MBSFNAreaConfiguration_r9_t **mbsfnAreaConfiguration) { asn_enc_rval_t enc_rval; @@ -4148,7 +4155,7 @@ uint8_t do_MBSFNAreaConfig(uint8_t Mod_id, NULL, (void *)mcch_message, buffer, - 100); + buffer_size); if(enc_rval.encoded == -1) { LOG_I(RRC, "[eNB AssertFatal]ASN1 message encoding failed (%s, %lu)!\n", @@ -4167,7 +4174,9 @@ uint8_t do_MBSFNAreaConfig(uint8_t Mod_id, } -uint8_t do_MeasurementReport(uint8_t Mod_id, uint8_t *buffer,int measid,int phy_id,long rsrp_s,long rsrq_s,long rsrp_t,long rsrq_t) { +uint8_t do_MeasurementReport(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, + int measid, int phy_id, long rsrp_s, long rsrq_s, + long rsrp_t, long rsrq_t) { asn_enc_rval_t enc_rval; LTE_UL_DCCH_Message_t ul_dcch_msg; LTE_MeasurementReport_t *measurementReport; @@ -4239,7 +4248,7 @@ uint8_t do_MeasurementReport(uint8_t Mod_id, uint8_t *buffer,int measid,int phy_ NULL, (void *)&ul_dcch_msg, buffer, - 100); + buffer_size); if(enc_rval.encoded == -1) { LOG_I(RRC, "[eNB AssertFatal]ASN1 message encoding failed (%s, %lu)!\n", @@ -4422,7 +4431,8 @@ uint8_t do_DLInformationTransfer(uint8_t Mod_id, uint8_t **buffer, uint8_t trans return encoded; } -uint8_t do_Paging(uint8_t Mod_id, uint8_t *buffer, ue_paging_identity_t ue_paging_identity, cn_domain_t cn_domain) { +uint8_t do_Paging(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, + ue_paging_identity_t ue_paging_identity, cn_domain_t cn_domain) { LOG_D(RRC, "[eNB %d] do_Paging start\n", Mod_id); asn_enc_rval_t enc_rval; LTE_PCCH_Message_t pcch_msg; @@ -4474,7 +4484,8 @@ uint8_t do_Paging(uint8_t Mod_id, uint8_t *buffer, ue_paging_identity_t ue_pagin ASN_SEQUENCE_ADD(&pcch_msg.message.choice.c1.choice.paging.pagingRecordList->list, paging_record_p); LOG_D(RRC, "[eNB %d] do_Paging paging_record: cn_Domain %ld, ue_paging_identity.presenceMask %d, PagingRecordList.count %d\n", Mod_id, paging_record_p->cn_Domain, ue_paging_identity.presenceMask, pcch_msg.message.choice.c1.choice.paging.pagingRecordList->list.count); - enc_rval = uper_encode_to_buffer(&asn_DEF_LTE_PCCH_Message, NULL, (void *)&pcch_msg, buffer, RRC_BUF_SIZE); + enc_rval = uper_encode_to_buffer(&asn_DEF_LTE_PCCH_Message, NULL, (void *)&pcch_msg, + buffer, buffer_size); if(enc_rval.encoded == -1) { LOG_I(RRC, "[eNB AssertFatal]ASN1 message encoding failed (%s, %lu)!\n", diff --git a/openair2/RRC/LTE/MESSAGES/asn1_msg.h b/openair2/RRC/LTE/MESSAGES/asn1_msg.h index 93c4c8e411..d832cba6e5 100644 --- a/openair2/RRC/LTE/MESSAGES/asn1_msg.h +++ b/openair2/RRC/LTE/MESSAGES/asn1_msg.h @@ -130,7 +130,7 @@ routine only generates an mo-data establishment cause. @param rv 5 byte random string or S-TMSI @returns Size of encoded bit stream in bytes*/ -uint8_t do_RRCConnectionRequest(uint8_t Mod_id, uint8_t *buffer,uint8_t *rv); +uint8_t do_RRCConnectionRequest(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, uint8_t *rv); /** \brief Generate an SidelinkUEInformation UL-DCCH-Message (UE). @@ -207,6 +207,7 @@ uint16_t do_RRCConnectionReconfiguration_BR( const protocol_ctxt_t *const ctxt_pP, uint8_t *buffer, + size_t buffer_size, uint8_t Transaction_id, LTE_SRB_ToAddModList_t *SRB_list, LTE_DRB_ToAddModList_t *DRB_list, @@ -252,6 +253,7 @@ uint16_t do_RRCConnectionReconfiguration( const protocol_ctxt_t *const ctxt_pP, uint8_t *buffer, + size_t buffer_size, uint8_t Transaction_id, LTE_SRB_ToAddModList_t *SRB_list, LTE_DRB_ToAddModList_t *DRB_list, @@ -325,14 +327,8 @@ routine only generates an mo-data establishment cause. @param transaction_id Transaction index @returns Size of encoded bit stream in bytes*/ -uint8_t do_RRCConnectionRelease(uint8_t Mod_id, uint8_t *buffer,int Transaction_id); +uint8_t do_RRCConnectionRelease(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, int Transaction_id); -/*** - * \brief Generate an MCCH-Message (eNB). This routine configures MBSFNAreaConfiguration (PMCH-InfoList and Subframe Allocation for MBMS data) - * @param buffer Pointer to PER-encoded ASN.1 description of MCCH-Message PDU - * @returns Size of encoded bit stream in bytes -*/ -uint8_t do_MCCHMessage(uint8_t *buffer); /*** * \brief Generate an MCCH-Message (eNB). This routine configures MBSFNAreaConfiguration (PMCH-InfoList and Subframe Allocation for MBMS data) * @param buffer Pointer to PER-encoded ASN.1 description of MCCH-Message PDU @@ -341,10 +337,14 @@ uint8_t do_MCCHMessage(uint8_t *buffer); uint8_t do_MBSFNAreaConfig(uint8_t Mod_id, uint8_t sync_area, uint8_t *buffer, + size_t buffer_size, LTE_MCCH_Message_t *mcch_message, LTE_MBSFNAreaConfiguration_r9_t **mbsfnAreaConfiguration); -ssize_t do_MeasurementReport(uint8_t Mod_id, uint8_t *buffer,int measid,int phy_id,long rsrp_s,long rsrq_s,long rsrp_t,long rsrq_t); +ssize_t do_MeasurementReport(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, + int measid, int phy_id, + long rsrp_s, long rsrq_s, + long rsrp_t, long rsrq_t); ssize_t do_nrMeasurementReport(uint8_t *buffer, size_t bufsize, @@ -357,7 +357,8 @@ ssize_t do_nrMeasurementReport(uint8_t *buffer, uint8_t do_DLInformationTransfer(uint8_t Mod_id, uint8_t **buffer, uint8_t transaction_id, uint32_t pdu_length, uint8_t *pdu_buffer); -uint8_t do_Paging(uint8_t Mod_id, uint8_t *buffer, ue_paging_identity_t ue_paging_identity, cn_domain_t cn_domain); +uint8_t do_Paging(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, + ue_paging_identity_t ue_paging_identity, cn_domain_t cn_domain); uint8_t do_ULInformationTransfer(uint8_t **buffer, uint32_t pdu_length, uint8_t *pdu_buffer); @@ -375,6 +376,7 @@ uint8_t do_UECapabilityEnquiry( const protocol_ctxt_t *const ctxt_pP, uint8_t *const buffer, + size_t buffer_size, const uint8_t Transaction_id, int16_t eutra_band, uint32_t nr_band); @@ -383,6 +385,7 @@ uint8_t do_NR_UECapabilityEnquiry( const protocol_ctxt_t *const ctxt_pP, uint8_t *const buffer, + size_t buffer_size, const uint8_t Transaction_id, int16_t eutra_band, uint32_t nr_band); @@ -390,6 +393,7 @@ do_NR_UECapabilityEnquiry( uint8_t do_SecurityModeCommand( const protocol_ctxt_t *const ctxt_pP, uint8_t *const buffer, + size_t buffer_size, const uint8_t Transaction_id, const uint8_t cipheringAlgorithm, const uint8_t integrityProtAlgorithm); diff --git a/openair2/RRC/LTE/MESSAGES/asn1_msg_NB_IoT.c b/openair2/RRC/LTE/MESSAGES/asn1_msg_NB_IoT.c index 350a8baf77..d13dcb9918 100644 --- a/openair2/RRC/LTE/MESSAGES/asn1_msg_NB_IoT.c +++ b/openair2/RRC/LTE/MESSAGES/asn1_msg_NB_IoT.c @@ -834,6 +834,7 @@ uint8_t do_UECapabilityEnquiry_NB_IoT( uint16_t do_RRCConnectionReconfiguration_NB_IoT( const protocol_ctxt_t *const ctxt_pP, uint8_t *buffer, + size_t buffer_size, uint8_t Transaction_id, LTE_SRB_ToAddModList_NB_r13_t *SRB1_list_NB, //SRB_ConfigList2 (default)--> only SRB1 LTE_DRB_ToAddModList_NB_r13_t *DRB_list_NB_IoT, //DRB_ConfigList (default) @@ -886,7 +887,7 @@ uint16_t do_RRCConnectionReconfiguration_NB_IoT( NULL, (void *)&dl_dcch_msg_NB_IoT, buffer, - RRC_BUF_SIZE); + buffer_size); if (enc_rval.encoded <= 0) { LOG_E(RRC, "ASN1 message encoding failed %s, %li\n", @@ -1020,7 +1021,8 @@ uint8_t do_DLInformationTransfer_NB_IoT( /*do_RRCConnectionReestablishment_NB-->used to re-establish SRB1*/ //which parameter to use? uint8_t do_RRCConnectionReestablishment_NB_IoT( uint8_t Mod_id, - uint8_t *const buffer, + uint8_t *buffer, + size_t buffer_size, const uint8_t Transaction_id, const NB_IoT_DL_FRAME_PARMS *const frame_parms, //to be changed LTE_SRB_ToAddModList_NB_r13_t *SRB_list_NB_IoT) { //should contain SRB1 already configured? @@ -1046,7 +1048,7 @@ uint8_t do_RRCConnectionReestablishment_NB_IoT( NULL, (void *)&dl_ccch_msg_NB_IoT, buffer, - RRC_BUF_SIZE); + buffer_size); if (enc_rval.encoded <= 0) { LOG_E(RRC, "ASN1 message encoding failed (%s, %li)!\n", @@ -1065,6 +1067,7 @@ uint8_t do_RRCConnectionReestablishment_NB_IoT( uint8_t do_RRCConnectionRelease_NB_IoT( uint8_t Mod_id, uint8_t *buffer, + size_t buffer_size, const uint8_t Transaction_id) { asn_enc_rval_t enc_rval; LTE_DL_DCCH_Message_NB_t dl_dcch_msg_NB_IoT; @@ -1087,7 +1090,7 @@ uint8_t do_RRCConnectionRelease_NB_IoT( NULL, (void *)&dl_dcch_msg_NB_IoT, buffer, - RRC_BUF_SIZE);//check + buffer_size); return((enc_rval.encoded+7)/8); } diff --git a/openair2/RRC/LTE/MESSAGES/asn1_msg_NB_IoT.h b/openair2/RRC/LTE/MESSAGES/asn1_msg_NB_IoT.h index 09af6ef021..de3aaa5155 100644 --- a/openair2/RRC/LTE/MESSAGES/asn1_msg_NB_IoT.h +++ b/openair2/RRC/LTE/MESSAGES/asn1_msg_NB_IoT.h @@ -184,6 +184,7 @@ uint16_t do_RRCConnectionReconfiguration_NB_IoT( const protocol_ctxt_t* const ctxt_pP, uint8_t *buffer, + size_t buffer_size, uint8_t Transaction_id, SRB_ToAddModList_NB_r13_t *SRB_list_NB_IoT, DRB_ToAddModList_NB_r13_t *DRB_list_NB_IoT, @@ -255,8 +256,8 @@ do_RRCConnectionReject_NB_IoT( @param transaction_id Transaction index @returns Size of encoded bit stream in bytes*/ -uint8_t do_RRCConnectionRelease_NB_IoT(uint8_t Mod_id, uint8_t *buffer,int Transaction_id); - +uint8_t do_RRCConnectionRelease_NB_IoT(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, + int Transaction_id); uint8_t do_DLInformationTransfer_NB_IoT( uint8_t Mod_id, @@ -279,7 +280,8 @@ uint8_t do_DLInformationTransfer_NB_IoT( uint8_t do_RRCConnectionReestablishment_NB_IoT( uint8_t Mod_id, - uint8_t* const buffer, + uint8_t* buffer, + size_t buffer_size, const uint8_t Transaction_id, const NB_IoT_DL_FRAME_PARMS* const frame_parms, //to be changed SRB_ToAddModList_NB_r13_t** SRB_configList_NB_IoT diff --git a/openair2/RRC/LTE/defs_NB_IoT.h b/openair2/RRC/LTE/defs_NB_IoT.h index 3907d2321d..8d2f3fd725 100644 --- a/openair2/RRC/LTE/defs_NB_IoT.h +++ b/openair2/RRC/LTE/defs_NB_IoT.h @@ -147,7 +147,6 @@ typedef struct UE_RRC_INFO_NB_IoT_s { //Measurement Report not supported in NB-IoT -#define PAYLOAD_SIZE_MAX 1024 #define RRC_BUF_SIZE 8192 #define UNDEF_SECURITY_MODE 0xff #define NO_SECURITY_MODE 0x20 diff --git a/openair2/RRC/LTE/rrc_UE.c b/openair2/RRC/LTE/rrc_UE.c index 6c99e4a01a..bc9f7890b6 100644 --- a/openair2/RRC/LTE/rrc_UE.c +++ b/openair2/RRC/LTE/rrc_UE.c @@ -456,6 +456,7 @@ void rrc_ue_generate_RRCConnectionRequest( const protocol_ctxt_t *const ctxt_pP, do_RRCConnectionRequest( ctxt_pP->module_id, (uint8_t *)UE_rrc_inst[ctxt_pP->module_id].Srb0[eNB_index].Tx_buffer.Payload, + sizeof(UE_rrc_inst[ctxt_pP->module_id].Srb0[eNB_index].Tx_buffer.Payload), rv); LOG_I(RRC,"[UE %d] : Frame %d, Logical Channel UL-CCCH (SRB0), Generating RRCConnectionRequest (bytes %d, eNB %d)\n", ctxt_pP->module_id, ctxt_pP->frame, UE_rrc_inst[ctxt_pP->module_id].Srb0[eNB_index].Tx_buffer.payload_size, eNB_index); @@ -4450,7 +4451,8 @@ void rrc_ue_generate_MeasurementReport(protocol_ctxt_t *const ctxt_pP, uint8_t e (long int)rsrq_s, (long int)rsrp_t, (long int)rsrq_t); - ssize_t size = do_MeasurementReport(ctxt_pP->module_id, buffer,measId,targetCellId,rsrp_s,rsrq_s,rsrp_t,rsrq_t); + ssize_t size = do_MeasurementReport(ctxt_pP->module_id, buffer, sizeof(buffer), + measId, targetCellId, rsrp_s, rsrq_s, rsrp_t, rsrq_t); AssertFatal(size >= 0, "do_MeasurementReport failed \n"); LOG_I(RRC, "[UE %d] Frame %d : Generating Measurement Report for eNB %d. Size is %zu\n", ctxt_pP->module_id, ctxt_pP->frame, eNB_index, size); diff --git a/openair2/RRC/LTE/rrc_defs.h b/openair2/RRC/LTE/rrc_defs.h index 3c6aa60c9e..5c2c69a27f 100644 --- a/openair2/RRC/LTE/rrc_defs.h +++ b/openair2/RRC/LTE/rrc_defs.h @@ -328,7 +328,6 @@ typedef enum SL_TRIGGER_e { #define MAX_MEAS_CONFIG 7 #define MAX_MEAS_ID 7 -#define PAYLOAD_SIZE_MAX 1024 #define RRC_BUF_SIZE 8192 #define UNDEF_SECURITY_MODE 0xff #define NO_SECURITY_MODE 0x20 diff --git a/openair2/RRC/LTE/rrc_eNB.c b/openair2/RRC/LTE/rrc_eNB.c index e51fe28fc3..e84d946e0a 100644 --- a/openair2/RRC/LTE/rrc_eNB.c +++ b/openair2/RRC/LTE/rrc_eNB.c @@ -537,6 +537,7 @@ init_MCCH( RC.rrc[enb_mod_idP]->carrier[CC_id].sizeof_MCCH_MESSAGE[sync_area] = do_MBSFNAreaConfig(enb_mod_idP, sync_area, (uint8_t *)RC.rrc[enb_mod_idP]->carrier[CC_id].MCCH_MESSAGE[sync_area], + 100, /* TODO: what is the actual size of .MCCH_MESSAGE[sync_area]? */ &RC.rrc[enb_mod_idP]->carrier[CC_id].mcch, &RC.rrc[enb_mod_idP]->carrier[CC_id].mcch_message); LOG_I(RRC, "mcch message pointer %p for sync area %d \n", @@ -1230,6 +1231,7 @@ rrc_eNB_generate_SecurityModeCommand( size = do_SecurityModeCommand( ctxt_pP, buffer, + sizeof(buffer), rrc_eNB_get_next_transaction_identifier(ctxt_pP->module_id), ue_context_pP->ue_context.ciphering_algorithm, ue_context_pP->ue_context.integrity_algorithm); @@ -1284,6 +1286,7 @@ rrc_eNB_generate_UECapabilityEnquiry( size = do_UECapabilityEnquiry( ctxt_pP, buffer, + sizeof(buffer), rrc_eNB_get_next_transaction_identifier(ctxt_pP->module_id), eutra_band, nr_band); @@ -1334,6 +1337,7 @@ rrc_eNB_generate_NR_UECapabilityEnquiry( size = do_NR_UECapabilityEnquiry( ctxt_pP, buffer, + sizeof(buffer), rrc_eNB_get_next_transaction_identifier(ctxt_pP->module_id), eutra_band, nr_band); @@ -2000,9 +2004,10 @@ rrc_eNB_process_RRCConnectionReestablishmentComplete( measurements_enabled = RC.rrc[ENB_INSTANCE_TO_MODULE_ID(ctxt_pP->instance)]->configuration.enable_x2 || RC.rrc[ENB_INSTANCE_TO_MODULE_ID(ctxt_pP->instance)]->configuration.enable_measurement_reports; // send LTE_RRCConnectionReconfiguration - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); size = do_RRCConnectionReconfiguration(ctxt_pP, buffer, + sizeof(buffer), next_xid, //Transaction_id, (LTE_SRB_ToAddModList_t *)*SRB_configList2, // SRB_configList (LTE_DRB_ToAddModList_t *)DRB_configList, @@ -2198,7 +2203,7 @@ rrc_eNB_generate_RRCConnectionRelease( uint8_t buffer[RRC_BUF_SIZE]; uint16_t size = 0; int release_num; - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); T(T_ENB_RRC_CONNECTION_RELEASE, T_INT(ctxt_pP->module_id), T_INT(ctxt_pP->frame), T_INT(ctxt_pP->subframe), T_INT(ctxt_pP->rnti)); #if 0 @@ -2210,7 +2215,8 @@ rrc_eNB_generate_RRCConnectionRelease( } #endif - size = do_RRCConnectionRelease(ctxt_pP->module_id, buffer,rrc_eNB_get_next_transaction_identifier(ctxt_pP->module_id)); + size = do_RRCConnectionRelease(ctxt_pP->module_id, buffer, sizeof(buffer), + rrc_eNB_get_next_transaction_identifier(ctxt_pP->module_id)); ue_context_pP->ue_context.ue_reestablishment_timer = 0; ue_context_pP->ue_context.ue_release_timer = 0; ue_context_pP->ue_context.ue_rrc_inactivity_timer = 0; @@ -2486,9 +2492,10 @@ rrc_eNB_generate_dedicatedRRCConnectionReconfiguration(const protocol_ctxt_t *co LOG_W(RRC,"dedlicated NAS list is empty\n"); } - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); size = do_RRCConnectionReconfiguration(ctxt_pP, buffer, + sizeof(buffer), xid, (LTE_SRB_ToAddModList_t *)NULL, (LTE_DRB_ToAddModList_t *)*DRB_configList2, @@ -2733,9 +2740,9 @@ rrc_eNB_modify_dedicatedRRCConnectionReconfiguration(const protocol_ctxt_t *cons LOG_W(RRC,"dedlicated NAS list is empty\n"); } - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); size = do_RRCConnectionReconfiguration(ctxt_pP, - buffer, + buffer, sizeof(buffer), xid, (LTE_SRB_ToAddModList_t *)NULL, (LTE_DRB_ToAddModList_t *)DRB_configList2, @@ -2834,9 +2841,10 @@ rrc_eNB_generate_dedicatedRRCConnectionReconfiguration_release( const protocol_ LOG_W(RRC,"dedlicated NAS list is empty\n"); } - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); size = do_RRCConnectionReconfiguration(ctxt_pP, buffer, + sizeof(buffer), xid, NULL, NULL, @@ -3544,9 +3552,10 @@ void rrc_eNB_generate_defaultRRCConnectionReconfiguration(const protocol_ctxt_t measurements_enabled = RC.rrc[ENB_INSTANCE_TO_MODULE_ID(ctxt_pP->instance)]->configuration.enable_x2 || RC.rrc[ENB_INSTANCE_TO_MODULE_ID(ctxt_pP->instance)]->configuration.enable_measurement_reports; - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); size = do_RRCConnectionReconfiguration(ctxt_pP, buffer, + sizeof(buffer), xid, // Transaction_id, (LTE_SRB_ToAddModList_t *) *SRB_configList2, // SRB_configList (LTE_DRB_ToAddModList_t *) *DRB_configList, @@ -4260,9 +4269,10 @@ flexran_rrc_eNB_generate_defaultRRCConnectionReconfiguration(const protocol_ctxt measurements_enabled = RC.rrc[ENB_INSTANCE_TO_MODULE_ID(ctxt_pP->instance)]->configuration.enable_x2 || RC.rrc[ENB_INSTANCE_TO_MODULE_ID(ctxt_pP->instance)]->configuration.enable_measurement_reports; - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); size = do_RRCConnectionReconfiguration(ctxt_pP, buffer, + sizeof(buffer), xid, // Transaction_id, (LTE_SRB_ToAddModList_t *) *SRB_configList2, // SRB_configList (LTE_DRB_ToAddModList_t *) *DRB_configList, @@ -4360,6 +4370,7 @@ rrc_eNB_generate_RRCConnectionReconfiguration_SCell( size = do_RRCConnectionReconfiguration(ctxt_pP, buffer, + sizeof(buffer), rrc_eNB_get_next_transaction_identifier(ctxt_pP->module_id),//Transaction_id, (LTE_SRB_ToAddModList_t *)NULL, (LTE_DRB_ToAddModList_t *)NULL, @@ -5155,7 +5166,9 @@ check_handovers( // Configure target ue_context_p->ue_context.handover_info->state = HO_FORWARDING; msg = itti_alloc_new_message(TASK_RRC_ENB, 0, X2AP_HANDOVER_REQ_ACK); - rrc_eNB_generate_HO_RRCConnectionReconfiguration(ctxt_pP, ue_context_p, X2AP_HANDOVER_REQ_ACK(msg).rrc_buffer, + rrc_eNB_generate_HO_RRCConnectionReconfiguration(ctxt_pP, ue_context_p, + X2AP_HANDOVER_REQ_ACK(msg).rrc_buffer, + RRC_BUF_SIZE, // TODO: supposed to be size of the .rrc_buffer. Is this right? &X2AP_HANDOVER_REQ_ACK(msg).rrc_buffer_size); rrc_eNB_configure_rbs_handover(ue_context_p,ctxt_pP); X2AP_HANDOVER_REQ_ACK(msg).rnti = ue_context_p->ue_context.rnti; @@ -5317,6 +5330,7 @@ void rrc_eNB_generate_HO_RRCConnectionReconfiguration(const protocol_ctxt_t *const ctxt_pP, rrc_eNB_ue_context_t *const ue_context_pP, uint8_t *buffer, + size_t buffer_size, int *_size //const uint8_t ho_state ) @@ -6258,11 +6272,12 @@ rrc_eNB_generate_HO_RRCConnectionReconfiguration(const protocol_ctxt_t *const ct measurements_enabled = RC.rrc[ENB_INSTANCE_TO_MODULE_ID(ctxt_pP->instance)]->configuration.enable_x2 || RC.rrc[ENB_INSTANCE_TO_MODULE_ID(ctxt_pP->instance)]->configuration.enable_measurement_reports; - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, buffer_size); char rrc_buf[1000 /* arbitrary, should be big enough, has to be less than size of return buf by a few bits/bytes */]; int rrc_size; rrc_size = do_RRCConnectionReconfiguration(ctxt_pP, (unsigned char *)rrc_buf, + sizeof(rrc_buf), xid, //Transaction_id, NULL, // SRB_configList NULL, @@ -6298,7 +6313,7 @@ rrc_eNB_generate_HO_RRCConnectionReconfiguration(const protocol_ctxt_t *const ct char *ho_buf = (char *)buffer; int ho_size; ho_size = do_HandoverCommand( - ho_buf, 1024 /* TODO: this is the value found in struct x2ap_handover_req_ack_s for array rrc_buffer */, + ho_buf, buffer_size, rrc_buf, rrc_size); *_size = size = ho_size; @@ -10042,7 +10057,7 @@ rrc_eNB_generate_RRCConnectionReconfiguration_Sidelink( { uint8_t buffer[RRC_BUF_SIZE]; uint16_t size = 0; - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); // allocate dedicated pools for UE -sl-CommConfig/sl-DiscConfig (sl-V2X-ConfigDedicated) //populate dedicated resources for SL communication (sl-CommConfig) @@ -10055,6 +10070,7 @@ rrc_eNB_generate_RRCConnectionReconfiguration_Sidelink( sl_CommConfig[0] = rrc_eNB_get_sidelink_commTXPool(ctxt_pP, ue_context_pP, destinationInfoList); size = do_RRCConnectionReconfiguration(ctxt_pP, buffer, + sizeof(buffer), rrc_eNB_get_next_transaction_identifier(ctxt_pP->module_id), //Transaction_id (LTE_SRB_ToAddModList_t *)NULL, (LTE_DRB_ToAddModList_t *)NULL, @@ -10077,6 +10093,7 @@ rrc_eNB_generate_RRCConnectionReconfiguration_Sidelink( sl_DiscConfig[0] = rrc_eNB_get_sidelink_discTXPool(ctxt_pP, ue_context_pP, n_discoveryMessages ); size = do_RRCConnectionReconfiguration(ctxt_pP, buffer, + sizeof(buffer), rrc_eNB_get_next_transaction_identifier(ctxt_pP->module_id), //Transaction_id (LTE_SRB_ToAddModList_t *)NULL, (LTE_DRB_ToAddModList_t *)NULL, diff --git a/openair2/RRC/LTE/rrc_eNB_S1AP.c b/openair2/RRC/LTE/rrc_eNB_S1AP.c index 9c01030cd7..a7d3cde98a 100644 --- a/openair2/RRC/LTE/rrc_eNB_S1AP.c +++ b/openair2/RRC/LTE/rrc_eNB_S1AP.c @@ -1970,7 +1970,7 @@ int rrc_eNB_process_PAGING_IND(MessageDef *msg_p, const char *msg_name, instance message_p = itti_alloc_new_message (TASK_RRC_ENB, 0, RRC_PCCH_DATA_REQ); /* Create message for PDCP (DLInformationTransfer_t) */ length = do_Paging (instance, - buffer, + buffer, sizeof(buffer), S1AP_PAGING_IND(msg_p).ue_paging_identity, S1AP_PAGING_IND(msg_p).cn_domain); diff --git a/openair2/RRC/LTE/rrc_proto.h b/openair2/RRC/LTE/rrc_proto.h index 034eb126d8..da6057aafd 100644 --- a/openair2/RRC/LTE/rrc_proto.h +++ b/openair2/RRC/LTE/rrc_proto.h @@ -313,6 +313,7 @@ void rrc_eNB_generate_HO_RRCConnectionReconfiguration(const protocol_ctxt_t *const ctxt_pP, rrc_eNB_ue_context_t *const ue_context_pP, uint8_t *buffer, + size_t buffer_size, int *_size //const uint8_t ho_state ); diff --git a/openair2/RRC/NR/MESSAGES/asn1_msg.c b/openair2/RRC/NR/MESSAGES/asn1_msg.c index b5c0ae53c6..75046ab7d5 100755 --- a/openair2/RRC/NR/MESSAGES/asn1_msg.c +++ b/openair2/RRC/NR/MESSAGES/asn1_msg.c @@ -1538,6 +1538,7 @@ uint8_t do_NR_SA_UECapabilityEnquiry( const protocol_ctxt_t *const ctxt_pP, uint8_t do_NR_RRCRelease(uint8_t *buffer, + size_t buffer_size, uint8_t Transaction_id) { asn_enc_rval_t enc_rval; NR_DL_DCCH_Message_t dl_dcch_msg; @@ -1563,7 +1564,7 @@ uint8_t do_NR_RRCRelease(uint8_t *buffer, NULL, (void *)&dl_dcch_msg, buffer, - RRC_BUF_SIZE); + buffer_size); if(enc_rval.encoded == -1) { LOG_I(NR_RRC, "[gNB AssertFatal]ASN1 message encoding failed (%s, %lu)!\n", enc_rval.failed_type->name, enc_rval.encoded); @@ -1576,6 +1577,7 @@ uint8_t do_NR_RRCRelease(uint8_t *buffer, int16_t do_RRCReconfiguration( const protocol_ctxt_t *const ctxt_pP, uint8_t *buffer, + size_t buffer_size, uint8_t Transaction_id, NR_SRB_ToAddModList_t *SRB_configList, NR_DRB_ToAddModList_t *DRB_configList, @@ -1671,7 +1673,7 @@ int16_t do_RRCReconfiguration( NULL, (void *)&dl_dcch_msg, buffer, - 1000); + buffer_size); if(enc_rval.encoded == -1) { LOG_I(NR_RRC, "[gNB AssertFatal]ASN1 message encoding failed (%s, %lu)!\n", @@ -1696,7 +1698,7 @@ int16_t do_RRCReconfiguration( } -uint8_t do_RRCSetupRequest(uint8_t Mod_id, uint8_t *buffer,uint8_t *rv) { +uint8_t do_RRCSetupRequest(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, uint8_t *rv) { asn_enc_rval_t enc_rval; uint8_t buf[5],buf2=0; NR_UL_CCCH_Message_t ul_ccch_msg; @@ -1740,7 +1742,7 @@ uint8_t do_RRCSetupRequest(uint8_t Mod_id, uint8_t *buffer,uint8_t *rv) { NULL, (void *)&ul_ccch_msg, buffer, - 100); + buffer_size); AssertFatal (enc_rval.encoded > 0, "ASN1 message encoding failed (%s, %lu)!\n", enc_rval.failed_type->name, enc_rval.encoded); LOG_D(NR_RRC,"[UE] RRCSetupRequest Encoded %zd bits (%zd bytes)\n", enc_rval.encoded, (enc_rval.encoded+7)/8); return((enc_rval.encoded+7)/8); @@ -1784,6 +1786,7 @@ uint8_t do_NR_RRCReconfigurationComplete( const protocol_ctxt_t *const ctxt_pP, uint8_t *buffer, + size_t buffer_size, const uint8_t Transaction_id ) //------------------------------------------------------------------------------ @@ -1811,14 +1814,15 @@ do_NR_RRCReconfigurationComplete( NULL, (void *)&ul_dcch_msg, buffer, - 100); + buffer_size); AssertFatal (enc_rval.encoded > 0, "ASN1 message encoding failed (%s, %lu)!\n", enc_rval.failed_type->name, enc_rval.encoded); LOG_I(NR_RRC,"rrcReconfigurationComplete Encoded %zd bits (%zd bytes)\n",enc_rval.encoded,(enc_rval.encoded+7)/8); return((enc_rval.encoded+7)/8); } -uint8_t do_RRCSetupComplete(uint8_t Mod_id, uint8_t *buffer, const uint8_t Transaction_id, uint8_t sel_plmn_id, const int dedicatedInfoNASLength, const char *dedicatedInfoNAS){ +uint8_t do_RRCSetupComplete(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, + const uint8_t Transaction_id, uint8_t sel_plmn_id, const int dedicatedInfoNASLength, const char *dedicatedInfoNAS){ asn_enc_rval_t enc_rval; NR_UL_DCCH_Message_t ul_dcch_msg; @@ -1861,7 +1865,7 @@ enc_rval = uper_encode_to_buffer(&asn_DEF_NR_UL_DCCH_Message, NULL, (void *)&ul_dcch_msg, buffer, - 100); + buffer_size); AssertFatal(enc_rval.encoded > 0,"ASN1 message encoding failed (%s, %lu)!\n", enc_rval.failed_type->name,enc_rval.encoded); LOG_D(NR_RRC,"RRCSetupComplete Encoded %zd bits (%zd bytes)\n",enc_rval.encoded,(enc_rval.encoded+7)/8); @@ -1976,6 +1980,7 @@ const protocol_ctxt_t *const ctxt_pP, rrc_gNB_ue_context_t *const ue_context_pP, int CC_id, uint8_t *const buffer, +size_t buffer_size, //const uint8_t transmission_mode, const uint8_t Transaction_id, NR_SRB_ToAddModList_t **SRB_configList @@ -2098,7 +2103,7 @@ NR_SRB_ToAddModList_t **SRB_configList } uint8_t -do_RRCReestablishmentComplete(uint8_t *buffer, int64_t rrc_TransactionIdentifier) { +do_RRCReestablishmentComplete(uint8_t *buffer, size_t buffer_size, int64_t rrc_TransactionIdentifier) { asn_enc_rval_t enc_rval; NR_UL_DCCH_Message_t ul_dcch_msg; NR_RRCReestablishmentComplete_t *rrcReestablishmentComplete; @@ -2124,7 +2129,7 @@ do_RRCReestablishmentComplete(uint8_t *buffer, int64_t rrc_TransactionIdentifier NULL, (void *)&ul_dcch_msg, buffer, - 100); + buffer_size); AssertFatal (enc_rval.encoded > 0, "ASN1 message encoding failed (%s, %lu)!\n", enc_rval.failed_type->name, enc_rval.encoded); LOG_D(NR_RRC,"[UE] RRCReestablishmentComplete Encoded %zd bits (%zd bytes)\n", enc_rval.encoded, (enc_rval.encoded+7)/8); return((enc_rval.encoded+7)/8); diff --git a/openair2/RRC/NR/MESSAGES/asn1_msg.h b/openair2/RRC/NR/MESSAGES/asn1_msg.h index 11d248bd84..a70f71ac15 100644 --- a/openair2/RRC/NR/MESSAGES/asn1_msg.h +++ b/openair2/RRC/NR/MESSAGES/asn1_msg.h @@ -28,6 +28,8 @@ * \email: raymond.knopp@eurecom.fr and navid.nikaein@eurecom.fr, kroempa@gmail.com */ +#pragma once + #include #include #include /* for atoi(3) */ @@ -116,12 +118,13 @@ uint8_t do_NR_SA_UECapabilityEnquiry( const protocol_ctxt_t *const ctxt_pP, uint8_t *const buffer, const uint8_t Transaction_id); -uint8_t do_NR_RRCRelease(uint8_t *buffer, +uint8_t do_NR_RRCRelease(uint8_t *buffer, size_t buffer_size, uint8_t Transaction_id); int16_t do_RRCReconfiguration( const protocol_ctxt_t *const ctxt_pP, uint8_t *buffer, + size_t buffer_size, uint8_t Transaction_id, NR_SRB_ToAddModList_t *SRB_configList, NR_DRB_ToAddModList_t *DRB_configList, @@ -132,21 +135,23 @@ int16_t do_RRCReconfiguration( struct NR_RRCReconfiguration_v1530_IEs__dedicatedNAS_MessageList *dedicatedNAS_MessageList, NR_MAC_CellGroupConfig_t *mac_CellGroupConfig, NR_CellGroupConfig_t *cellGroupConfig); - -uint8_t do_RRCSetupComplete(uint8_t Mod_id, - uint8_t *buffer, - const uint8_t Transaction_id, - uint8_t sel_plmn_id, - const int dedicatedInfoNASLength, + +uint8_t do_RRCSetupComplete(uint8_t Mod_id, + uint8_t *buffer, + size_t buffer_size, + const uint8_t Transaction_id, + uint8_t sel_plmn_id, + const int dedicatedInfoNASLength, const char *dedicatedInfoNAS); -uint8_t do_RRCSetupRequest(uint8_t Mod_id, uint8_t *buffer,uint8_t *rv); +uint8_t do_RRCSetupRequest(uint8_t Mod_id, uint8_t *buffer, size_t buffer_size, uint8_t *rv); uint8_t do_NR_RRCReconfigurationComplete_for_nsa(uint8_t *buffer, size_t buffer_size, NR_RRC_TransactionIdentifier_t Transaction_id); uint8_t do_NR_RRCReconfigurationComplete( const protocol_ctxt_t *const ctxt_pP, uint8_t *buffer, + size_t buffer_size, const uint8_t Transaction_id ); @@ -171,6 +176,7 @@ do_RRCReestablishment( rrc_gNB_ue_context_t *const ue_context_pP, int CC_id, uint8_t *const buffer, + size_t buffer_size, //const uint8_t transmission_mode, const uint8_t Transaction_id, NR_SRB_ToAddModList_t **SRB_configList @@ -178,6 +184,6 @@ do_RRCReestablishment( uint8_t do_RRCReestablishmentComplete( - uint8_t *buffer, + uint8_t *buffer, size_t buffer_size, int64_t rrc_TransactionIdentifier); diff --git a/openair2/RRC/NR/nr_rrc_defs.h b/openair2/RRC/NR/nr_rrc_defs.h index d6ba5880da..9f4ffdf6e2 100644 --- a/openair2/RRC/NR/nr_rrc_defs.h +++ b/openair2/RRC/NR/nr_rrc_defs.h @@ -127,7 +127,6 @@ typedef enum UE_STATE_NR_e { #define MAX_MEAS_CONFIG 7 #define MAX_MEAS_ID 7 -#define PAYLOAD_SIZE_MAX 1024 #define RRC_BUF_SIZE 8192 #define UNDEF_SECURITY_MODE 0xff #define NO_SECURITY_MODE 0x20 diff --git a/openair2/RRC/NR/rrc_gNB.c b/openair2/RRC/NR/rrc_gNB.c index b205a2ecdb..acf09dacbb 100755 --- a/openair2/RRC/NR/rrc_gNB.c +++ b/openair2/RRC/NR/rrc_gNB.c @@ -833,8 +833,8 @@ rrc_gNB_generate_defaultRRCReconfiguration( dedicatedNAS_MessageList = NULL; } - memset(buffer, 0, RRC_BUF_SIZE); - size = do_RRCReconfiguration(ctxt_pP, buffer, + memset(buffer, 0, sizeof(buffer)); + size = do_RRCReconfiguration(ctxt_pP, buffer, sizeof(buffer), xid, NULL, //*SRB_configList2, NULL, //*DRB_configList, @@ -1089,10 +1089,10 @@ rrc_gNB_generate_dedicatedRRCReconfiguration( dedicatedNAS_MessageList = NULL; } - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); cellGroupConfig = calloc(1, sizeof(NR_CellGroupConfig_t)); fill_mastercellGroupConfig(cellGroupConfig, ue_context_pP->ue_context.masterCellGroup); - size = do_RRCReconfiguration(ctxt_pP, buffer, + size = do_RRCReconfiguration(ctxt_pP, buffer, sizeof(buffer), xid, *SRB_configList2, *DRB_configList, @@ -1200,8 +1200,8 @@ rrc_gNB_generate_dedicatedRRCReconfiguration_release( LOG_W(NR_RRC,"dedlicated NAS list is empty\n"); } - memset(buffer, 0, RRC_BUF_SIZE); - size = do_RRCReconfiguration(ctxt_pP, buffer, xid, + memset(buffer, 0, sizeof(buffer)); + size = do_RRCReconfiguration(ctxt_pP, buffer, sizeof(buffer), xid, NULL, NULL, *DRB_Release_configList2, @@ -1462,6 +1462,7 @@ rrc_gNB_generate_RRCReestablishment( ue_context_pP, CC_id, (uint8_t *) ue_context->Srb0.Tx_buffer.Payload, + sizeof(ue_context->Srb0.Tx_buffer.Payload), //(uint8_t) carrier->p_gNB, // at this point we do not have the UE capability information, so it can only be TM1 or TM2 rrc_gNB_get_next_transaction_identifier(module_id), SRB_configList @@ -1717,9 +1718,9 @@ rrc_gNB_process_RRCConnectionReestablishmentComplete( i, ue_context_pP->ue_context.pduSession[i].status, "PDU_SESSION_STATUS_DONE"); } - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); - size = do_RRCReconfiguration(ctxt_pP, buffer, + size = do_RRCReconfiguration(ctxt_pP, buffer, sizeof(buffer), xid, *SRB_configList2, DRB_configList, @@ -3546,9 +3547,10 @@ rrc_gNB_generate_RRCRelease( uint8_t buffer[RRC_BUF_SIZE]; uint16_t size = 0; - memset(buffer, 0, RRC_BUF_SIZE); + memset(buffer, 0, sizeof(buffer)); - size = do_NR_RRCRelease(buffer,rrc_gNB_get_next_transaction_identifier(ctxt_pP->module_id)); + size = do_NR_RRCRelease(buffer, sizeof(buffer), + rrc_gNB_get_next_transaction_identifier(ctxt_pP->module_id)); ue_context_pP->ue_context.ue_reestablishment_timer = 0; ue_context_pP->ue_context.ue_release_timer = 0; ue_context_pP->ue_context.ul_failure_timer = 0; diff --git a/openair2/RRC/NR_UE/rrc_UE.c b/openair2/RRC/NR_UE/rrc_UE.c index cc5e65d90f..9e873054e4 100644 --- a/openair2/RRC/NR_UE/rrc_UE.c +++ b/openair2/RRC/NR_UE/rrc_UE.c @@ -116,6 +116,7 @@ nr_sa_rrc_ue_process_radioBearerConfig( uint8_t do_NR_RRCReconfigurationComplete( const protocol_ctxt_t *const ctxt_pP, uint8_t *buffer, + size_t buffer_size, const uint8_t Transaction_id ); @@ -1375,7 +1376,8 @@ static void rrc_ue_generate_RRCSetupComplete( nas_msg = nr_nas_attach_req_imsi; nas_msg_length = sizeof(nr_nas_attach_req_imsi); } - size = do_RRCSetupComplete(ctxt_pP->module_id,buffer,Transaction_id,sel_plmn_id,nas_msg_length,nas_msg); + size = do_RRCSetupComplete(ctxt_pP->module_id, buffer, sizeof(buffer), + Transaction_id, sel_plmn_id, nas_msg_length, nas_msg); LOG_I(NR_RRC,"[UE %d][RAPROC] Frame %d : Logical Channel UL-DCCH (SRB1), Generating RRCSetupComplete (bytes%d, gNB %d)\n", ctxt_pP->module_id,ctxt_pP->frame, size, gNB_index); LOG_D(NR_RRC, @@ -1780,6 +1782,7 @@ int8_t nr_rrc_ue_decode_ccch( const protocol_ctxt_t *const ctxt_pP, const NR_SRB do_RRCSetupRequest( module_id, (uint8_t *)NR_UE_rrc_inst[module_id].Srb0[gNB_index].Tx_buffer.Payload, + sizeof(NR_UE_rrc_inst[module_id].Srb0[gNB_index].Tx_buffer.Payload), rv); LOG_I(NR_RRC,"[UE %d] : Logical Channel UL-CCCH (SRB0), Generating RRCSetupRequest (bytes %d, gNB %d)\n", module_id, NR_UE_rrc_inst[module_id].Srb0[gNB_index].Tx_buffer.payload_size, gNB_index); @@ -2246,7 +2249,7 @@ nr_rrc_ue_establish_srb2( //----------------------------------------------------------------------------- void nr_rrc_ue_generate_RRCReconfigurationComplete( const protocol_ctxt_t *const ctxt_pP, const uint8_t gNB_index, const uint8_t Transaction_id ) { uint8_t buffer[32], size; - size = do_NR_RRCReconfigurationComplete(ctxt_pP, buffer, Transaction_id); + size = do_NR_RRCReconfigurationComplete(ctxt_pP, buffer, sizeof(buffer), Transaction_id); LOG_I(NR_RRC,PROTOCOL_RRC_CTXT_UE_FMT" Logical Channel UL-DCCH (SRB1), Generating RRCReconfigurationComplete (bytes %d, gNB_index %d)\n", PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP), size, gNB_index); LOG_D(RLC, @@ -2290,6 +2293,7 @@ nr_rrc_ue_establish_srb2( const protocol_ctxt_t *const ctxt_pP, const srb_id_t Srb_id, const uint8_t *const Buffer, + size_t Buffer_size, const uint8_t gNB_indexP ) //----------------------------------------------------------------------------- @@ -2310,7 +2314,7 @@ nr_rrc_ue_establish_srb2( &asn_DEF_NR_DL_DCCH_Message, (void **)&dl_dcch_msg, Buffer, - RRC_BUF_SIZE, + Buffer_size, 0, 0); @@ -2492,6 +2496,7 @@ nr_rrc_ue_establish_srb2( &ctxt, NR_RRC_DCCH_DATA_IND (msg_p).dcch_index, NR_RRC_DCCH_DATA_IND (msg_p).sdu_p, + NR_RRC_DCCH_DATA_IND (msg_p).sdu_size, NR_RRC_DCCH_DATA_IND (msg_p).gNB_index); break; @@ -2725,7 +2730,8 @@ nr_rrc_ue_generate_rrcReestablishmentComplete( { uint32_t length; uint8_t buffer[100]; - length = do_RRCReestablishmentComplete(buffer, rrcReestablishment->rrc_TransactionIdentifier); + length = do_RRCReestablishmentComplete(buffer, sizeof(buffer), + rrcReestablishment->rrc_TransactionIdentifier); LOG_I(NR_RRC,"[UE %d][RAPROC] Frame %d : Logical Channel UL-DCCH (SRB1), Generating RRCReestablishmentComplete (bytes%d, gNB %d)\n", ctxt_pP->module_id,ctxt_pP->frame, length, gNB_index); #ifdef ITTI_SIM