errors detected by undefined behavior sanitizer

nfapi/open-nFAPI/nfapi/src/nfapi.c

@@ -220,9 +220,9 @@ uint8_t pulls16(uint8_t **in, int16_t *out, uint8_t *end) {
 uint8_t pull32(uint8_t **in, uint32_t *out, uint8_t *end) {
   uint8_t *pIn = *in;
 
-  if((end - pIn) >=4 ) {
-    *out = (pIn[0] << 24) | (pIn[1] << 16) | (pIn[2] << 8) | pIn[3];
-    (*in)+=4;
+  if((end - pIn) >= 4) {
+    *out = ((uint32_t)pIn[0] << 24) | (pIn[1] << 16) | (pIn[2] << 8) | pIn[3];
+    (*in) += 4;
     return 4;
   } else {
     NFAPI_TRACE(NFAPI_TRACE_ERROR, "%s no space in buffer\n",  __FUNCTION__);

openair1/PHY/NR_REFSIG/nr_gold_ue.c

@@ -54,19 +54,16 @@ void nr_gold_pbch(PHY_VARS_NR_UE* ue)
 void nr_gold_pdcch(PHY_VARS_NR_UE* ue,
                    unsigned short nid)
 {
-  unsigned char ns,l;
   unsigned int n = 0, x1 = 0, x2 = 0, x2tmp0 = 0;
   uint8_t reset;
-  int pdcch_dmrs_init_length =  (((ue->frame_parms.N_RB_DL<<1)*3)>>5)+1;
-
-  for (ns=0; ns<ue->frame_parms.slots_per_frame; ns++) {
-
-    for (l=0; l<ue->frame_parms.symbols_per_slot; l++) {
+  int pdcch_dmrs_init_length = (((ue->frame_parms.N_RB_DL << 1) * 3) >> 5) + 1;
 
+  for (int ns = 0; ns < ue->frame_parms.slots_per_frame; ns++) {
+    for (int l = 0; l < ue->frame_parms.symbols_per_slot; l++) {
       reset = 1;
-      x2tmp0 = ((ue->frame_parms.symbols_per_slot*ns+l+1)*((nid<<1)+1))<<17;
-      x2 = (x2tmp0+(nid<<1))%(1U<<31);  //cinit
-      
+      x2tmp0 = ((ue->frame_parms.symbols_per_slot * ns + l + 1) * ((nid << 1) + 1));
+      x2tmp0 <<= 17;
+      x2 = (x2tmp0 + (nid << 1)) % (1U << 31);  //cinit
       for (n=0; n<pdcch_dmrs_init_length; n++) {
         ue->nr_gold_pdcch[0][ns][l][n] = lte_gold_generic(&x1, &x2, reset);
         reset = 0;
@@ -104,18 +101,15 @@ void nr_init_pusch_dmrs(PHY_VARS_NR_UE* ue,
                         uint8_t n_scid)
 {
   uint32_t x1 = 0, x2 = 0, n = 0;
-  uint8_t reset, slot, symb;
   NR_DL_FRAME_PARMS *fp = &ue->frame_parms;
   uint32_t ****pusch_dmrs = ue->nr_gold_pusch_dmrs;
-  int pusch_dmrs_init_length =  ((fp->N_RB_UL*12)>>5)+1;
+  int pusch_dmrs_init_length = ((fp->N_RB_UL * 12) >> 5) + 1;
 
-  for (slot=0; slot<fp->slots_per_frame; slot++) {
-
-    for (symb=0; symb<fp->symbols_per_slot; symb++) {
-
-      reset = 1;
-      x2 = ((1<<17) * (fp->symbols_per_slot*slot+symb+1) * ((N_n_scid<<1)+1) +((N_n_scid<<1)+n_scid));
-      LOG_D(PHY,"DMRS slot %d, symb %d x2 %x\n",slot,symb,x2);
+  for (int slot = 0; slot < fp->slots_per_frame; slot++) {
+    for (int symb = 0; symb < fp->symbols_per_slot; symb++) {
+      int reset = 1;
+      x2 = ((1U << 17) * (fp->symbols_per_slot*slot + symb + 1) * ((N_n_scid << 1) + 1) + ((N_n_scid << 1) + n_scid));
+      LOG_D(PHY,"DMRS slot %d, symb %d x2 %x\n", slot, symb, x2);
       for (n=0; n<pusch_dmrs_init_length; n++) {
         pusch_dmrs[slot][symb][n_scid][n] = lte_gold_generic(&x1, &x2, reset);
         reset = 0;

openair1/PHY/NR_UE_ESTIMATION/nr_adjust_synch_ue.c

@@ -96,7 +96,7 @@ void nr_adjust_synch_ue(NR_DL_FRAME_PARMS *frame_parms,
 
   const int sample_shift = -(ue->rx_offset>>1);
   // reset IIR filter for next offset calculation
-  ue->max_pos_fil += sample_shift << 15;
+  ue->max_pos_fil += sample_shift * 32768;
 
   if(abs(diff)<5)
     count_max_pos_ok ++;

openair1/PHY/NR_UE_TRANSPORT/dci_nr.c

@@ -315,11 +315,10 @@ void nr_pdcch_channel_level(int32_t rx_size,
       */
     }
 
-    DevAssert( nb_rb );
-    avg[aarx] = (((int32_t *)&avg128P)[0] +
-                 ((int32_t *)&avg128P)[1] +
-                 ((int32_t *)&avg128P)[2] +
-                 ((int32_t *)&avg128P)[3])/(nb_rb*9);
+    DevAssert(nb_rb);
+    avg[aarx] = 0;
+    for (int i = 0; i < 4; i++)
+      avg[aarx] += ((int32_t *)&avg128P)[i] / (nb_rb * 9);
     LOG_DDD("Channel level : %d\n",avg[aarx]);
   }
 

openair1/PHY/NR_UE_TRANSPORT/nr_pbch.c

@@ -232,10 +232,8 @@ int nr_pbch_channel_level(struct complex16 dl_ch_estimates_ext[][PBCH_MAX_RE_PER
       }*/
     }
 
-    avg1 = (((int *)&avg128)[0] +
-            ((int *)&avg128)[1] +
-            ((int *)&avg128)[2] +
-            ((int *)&avg128)[3])/(nb_rb*12);
+    for (int i = 0; i < 4; i++)
+      avg1 += ((int *)&avg128)[i] / (nb_rb * 12);
 
     if (avg1>avg2)
       avg2 = avg1;

openair1/PHY/defs_nr_UE.h

@@ -515,7 +515,7 @@ typedef struct {
   uint16_t         symbol_offset;  /// offset in terms of symbols for detected ssb in sync
   int              rx_offset;      /// Timing offset
   int              rx_offset_diff; /// Timing adjustment for ofdm symbol0 on HW USRP
-  int              max_pos_fil;    /// Timing offset IIR filter
+  int64_t          max_pos_fil;    /// Timing offset IIR filter
   bool             apply_timing_offset;     /// Do time sync for current frame
   int              time_sync_cell;
 

openair2/LAYER2/NR_MAC_UE/nr_ue_procedures.c

@@ -3798,7 +3798,7 @@ int nr_write_ce_ulsch_pdu(uint8_t *mac_ce,
     mac_ce++;
 
     // C-RNTI MAC CE (2 octets)
-    *(uint16_t *) mac_ce = (*crnti);
+    memcpy(mac_ce, crnti, sizeof(*crnti));
 
     // update pointer and length
     mac_ce_size = sizeof(uint16_t);

openair2/NR_UE_PHY_INTERFACE/NR_IF_Module.c

@@ -1162,7 +1162,8 @@ int nr_ue_dl_indication(nr_downlink_indication_t *dl_info)
                                 dl_info->frame,
                                 dl_info->slot,
                                 dl_info->dci_ind->dci_list+i);
-
+        if (ret < 0)
+          continue;
         fapi_nr_dci_indication_pdu_t *dci_index = dl_info->dci_ind->dci_list+i;
 
         /* The check below filters out UL_DCIs (format 7) which are being processed as DL_DCIs. */
@@ -1175,13 +1176,11 @@ int nr_ue_dl_indication(nr_downlink_indication_t *dl_info)
         LOG_T(NR_MAC, "Setting harq_pid = %d and dci_index = %d (based on format)\n", g_harq_pid, dci_index->dci_format);
 
         ret_mask |= (ret << FAPI_NR_DCI_IND);
-        if (ret >= 0) {
-          AssertFatal( nr_ue_if_module_inst[module_id] != NULL, "IF module is NULL!\n" );
-          AssertFatal( nr_ue_if_module_inst[module_id]->scheduled_response != NULL, "scheduled_response is NULL!\n" );
-          fapi_nr_dl_config_request_t *dl_config = get_dl_config_request(mac, dl_info->slot);
-          fill_scheduled_response(&scheduled_response, dl_config, NULL, NULL, dl_info->module_id, dl_info->cc_id, dl_info->frame, dl_info->slot, dl_info->phy_data);
-          nr_ue_if_module_inst[module_id]->scheduled_response(&scheduled_response);
-        }
+        AssertFatal( nr_ue_if_module_inst[module_id] != NULL, "IF module is NULL!\n" );
+        AssertFatal( nr_ue_if_module_inst[module_id]->scheduled_response != NULL, "scheduled_response is NULL!\n" );
+        fapi_nr_dl_config_request_t *dl_config = get_dl_config_request(mac, dl_info->slot);
+        fill_scheduled_response(&scheduled_response, dl_config, NULL, NULL, dl_info->module_id, dl_info->cc_id, dl_info->frame, dl_info->slot, dl_info->phy_data);
+        nr_ue_if_module_inst[module_id]->scheduled_response(&scheduled_response);
         memset(def_dci_pdu_rel15, 0, sizeof(*def_dci_pdu_rel15));
       }
       dl_info->dci_ind = NULL;