replace transient malloc by stack allocation, add defense code on block size

openair1/PHY/NR_UE_TRANSPORT/nr_dlsch_demodulation.c

@@ -104,12 +104,14 @@ static void nr_dlsch_layer_demapping(int16_t *llr_cw[2],
                                      uint32_t length,
                                      int32_t codeword_TB0,
                                      int32_t codeword_TB1,
-                                     int16_t *llr_layers[NR_MAX_NB_LAYERS]);
+                                     uint sz,
+                                     int16_t llr_layers[][sz]);
 
 /* compute LLR */
 static int nr_dlsch_llr(uint32_t rx_size_symbol,
                         int nbRx,
-                        int16_t *layer_llr[NR_MAX_NB_LAYERS],
+                        uint sz,
+                        int16_t layer_llr[][sz],
                         NR_DL_FRAME_PARMS *frame_parms,
                         int32_t rxdataF_comp[][nbRx][rx_size_symbol * NR_SYMBOLS_PER_SLOT],
                         int32_t dl_ch_mag[rx_size_symbol],
@@ -127,6 +129,7 @@ static int nr_dlsch_llr(uint32_t rx_size_symbol,
                         uint8_t nr_slot_rx,
                         NR_UE_DLSCH_t dlsch[2],
                         uint32_t llr_offset[NR_SYMBOLS_PER_SLOT]);
+
 /** \fn nr_dlsch_extract_rbs
     \brief This function extracts the received resource blocks, both channel estimates and data symbols,    for the current
    allocation and for multiple layer antenna gNB transmission.
@@ -575,12 +578,20 @@ int nr_rx_pdsch(PHY_VARS_NR_UE *ue,
   }
   /* at last symbol in a slot calculate LLR's for whole slot */
   if(symbol == (startSymbIdx + nbSymb -1)) {
+<<<<<<< HEAD
     const uint32_t rx_llr_layer_size = (G + dlsch[0].Nl - 1) / dlsch[0].Nl;
+=======
+    const uint rx_llr_layer_size = (dlsch0_harq->G + dlsch[0].Nl - 1) / dlsch[0].Nl;
 
-    int16_t* layer_llr[NR_MAX_NB_LAYERS];
-    for (int i = 0; i < NR_MAX_NB_LAYERS; i++)
-      layer_llr[i] = (int16_t *)malloc16_clear(rx_llr_layer_size * sizeof(int16_t));
-    for(uint8_t i = startSymbIdx; i < (startSymbIdx+nbSymb); i++) {
+    if (dlsch[0].Nl == 0 || rx_llr_layer_size == 0 || rx_llr_layer_size > 10 * 1000 * 1000) {
+      LOG_E(PHY, "rx_llr_layer_size %d, G %d, Nl, %d, discarding this pdsch\n", rx_llr_layer_size, dlsch0_harq->G, dlsch[0].Nl);
+      return -1;
+    }
+>>>>>>> effe4f1c814 (replace transient malloc by stack allocation, add defense code on block size)
+
+    int16_t layer_llr[dlsch[0].Nl][rx_llr_layer_size];
+    memset(layer_llr,0, sizeof(layer_llr));
+    for(int i = startSymbIdx; i < startSymbIdx+nbSymb; i++) {
       /* re evaluating the first symbol flag as LLR's are done in symbol loop  */
       if(i == startSymbIdx && i < 3)
         first_symbol_flag = 1;
@@ -589,6 +600,7 @@ int nr_rx_pdsch(PHY_VARS_NR_UE *ue,
       /* Calculate LLR's for each symbol */
       nr_dlsch_llr(rx_size_symbol,
                    nbRx,
+                   rx_llr_layer_size,
                    layer_llr,
                    frame_parms,
                    rxdataF_comp,
@@ -609,11 +621,23 @@ int nr_rx_pdsch(PHY_VARS_NR_UE *ue,
                    llr_offset);
     }
 
+<<<<<<< HEAD
     nr_dlsch_layer_demapping(llr, dlsch[0].Nl, dlsch[0].dlsch_config.qamModOrder, G, codeword_TB0, codeword_TB1, layer_llr);
     // if (llr[0][0]) abort();
     for (int i=0; i<NR_MAX_NB_LAYERS; i++)
       free(layer_llr[i]);
   // Please keep it: useful for debugging
+=======
+    nr_dlsch_layer_demapping(llr,
+                             dlsch[0].Nl,
+                             dlsch[0].dlsch_config.qamModOrder,
+                             dlsch0_harq->G,
+                             codeword_TB0,
+                             codeword_TB1,
+                             rx_llr_layer_size,
+                             layer_llr);
+    // Please keep it: useful for debugging
+>>>>>>> effe4f1c814 (replace transient malloc by stack allocation, add defense code on block size)
 #ifdef DEBUG_PDSCH_RX
     char filename[50];
     uint8_t aa = 0;
@@ -1867,8 +1891,9 @@ static void nr_dlsch_layer_demapping(int16_t *llr_cw[2],
                                      uint32_t length,
                                      int32_t codeword_TB0,
                                      int32_t codeword_TB1,
-                                     int16_t *llr_layers[NR_MAX_NB_LAYERS]) {
-
+                                     uint sz,
+                                     int16_t llr_layers[][sz])
+{
   switch (Nl) {
     case 1:
       if (codeword_TB1 == -1)
@@ -1901,7 +1926,8 @@ static void nr_dlsch_layer_demapping(int16_t *llr_cw[2],
 
 static int nr_dlsch_llr(uint32_t rx_size_symbol,
                         int nbRx,
-                        int16_t *layer_llr[NR_MAX_NB_LAYERS],
+                        uint sz,
+                        int16_t layer_llr[][sz],
                         NR_DL_FRAME_PARMS *frame_parms,
                         int32_t rxdataF_comp[][nbRx][rx_size_symbol * NR_SYMBOLS_PER_SLOT],
                         int32_t dl_ch_mag[rx_size_symbol],