From d8a7414e48b0121e1908bc30bd1ba8899139717d Mon Sep 17 00:00:00 2001 From: Michael Cook Date: Sat, 27 Feb 2021 09:16:27 -0800 Subject: [PATCH] eNB_scheduler_mch.c: Memory corruption The global mbms_rab_id was defined as `uint16_t` in eNB_scheduler_mch.c but `int` in other places. So, code that wrotes this global would clobber the two bytes that follow the variable in memory. Found by `-fsanitize=address`. --- openair2/LAYER2/MAC/eNB_scheduler_mch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openair2/LAYER2/MAC/eNB_scheduler_mch.c b/openair2/LAYER2/MAC/eNB_scheduler_mch.c index f3a77ed703..fbdffc3198 100644 --- a/openair2/LAYER2/MAC/eNB_scheduler_mch.c +++ b/openair2/LAYER2/MAC/eNB_scheduler_mch.c @@ -84,7 +84,7 @@ get_mbsfn_sf_alloction(module_id_t module_idP, uint8_t CC_id, static uint32_t bytes_in_buffer=0; static uint32_t msi_pmch_stop=0; -uint16_t mbms_rab_id=2047;//[8] = {2047,2047,2047,2047,2047,2047,2047,2047}; +int mbms_rab_id = 2047; static uint32_t msi_sfs=0;