maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix segfault in nr_pdcch_extract_rbs_single

Browse Source 
Fixed an issue where skipping unused PDCCH RBGs would cause the
function to write/read from outside the symbol boundary
This commit is contained in:
Bartosz Podrygajlo
2025-10-21 12:01:34 +02:00
parent 22a335b1a8
commit dcb69986eb
1 changed files with 35 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair1/PHY/NR_UE_TRANSPORT/dci_nr.c
+7 -8
View File
@@ -249,15 +249,12 @@ static void nr_pdcch_extract_rbs_single(uint32_t rxdataF_sz,
* the position 0+c_rb-N_RB_DL/2 in rxdataF and we have to point the pointer at (1+c_rb-N_RB_DL/2) in rxdataF * the position 0+c_rb-N_RB_DL/2 in rxdataF and we have to point the pointer at (1+c_rb-N_RB_DL/2) in rxdataF
*/ */
int c_rb = 0; for (int rb_group = 0; rb_group < coreset_nbr_rb / 6; rb_group++) {
for (int rb = 0; rb < coreset_nbr_rb; rb++, c_rb++) { if ((coreset_freq_dom[rb_group / 8] & (1 << (7 - (rb_group & 7)))) == 0) {
int c_rb_by6 = c_rb / 6; continue;
// skip zeros in frequency domain bitmap
while ((coreset_freq_dom[c_rb_by6 / 8] & (1 << (7 - (c_rb_by6 & 7)))) == 0) {
c_rb += 6;
c_rb_by6 = c_rb / 6;
} }
for (int rb = 0; rb < 6; rb++) {
int c_rb = rb_group * 6 + rb;
c16_t *rxF = NULL; c16_t *rxF = NULL;
if ((frame_parms->N_RB_DL & 1) == 0) { if ((frame_parms->N_RB_DL & 1) == 0) {
if ((c_rb + n_BWP_start) < frame_parms->N_RB_DL / 2) if ((c_rb + n_BWP_start) < frame_parms->N_RB_DL / 2)
@@ -281,6 +278,7 @@ static void nr_pdcch_extract_rbs_single(uint32_t rxdataF_sz,
// we point at the 1st part of the rxdataF in symbol // we point at the 1st part of the rxdataF in symbol
rxF = rxFbase + RE_PER_RB * (c_rb + n_BWP_start - frame_parms->N_RB_DL / 2) - 6; rxF = rxFbase + RE_PER_RB * (c_rb + n_BWP_start - frame_parms->N_RB_DL / 2) - 6;
} }
const int valid_re[RE_PER_RB_OUT_DMRS] = {0, 2, 3, 4, 6, 7, 8, 10, 11}; const int valid_re[RE_PER_RB_OUT_DMRS] = {0, 2, 3, 4, 6, 7, 8, 10, 11};
for (int i = 0; i < sizeofArray(valid_re); i++) { for (int i = 0; i < sizeofArray(valid_re); i++) {
*rxF_ext++ = rxF[valid_re[i]]; *rxF_ext++ = rxF[valid_re[i]];
@@ -290,6 +288,7 @@ static void nr_pdcch_extract_rbs_single(uint32_t rxdataF_sz,
} }
} }
} }
}
static void nr_pdcch_channel_compensation(int arraySz, static void nr_pdcch_channel_compensation(int arraySz,
c16_t rxdataF_ext[][arraySz], c16_t rxdataF_ext[][arraySz],