Merge remote-tracking branch 'origin/429-coverity-scan-fix-week22' into...

Merge remote-tracking branch 'origin/429-coverity-scan-fix-week22' into develop_integration_2019_w23

common/config/config_cmdline.c

@@ -41,7 +41,7 @@
 
 int parse_stringlist(paramdef_t *cfgoptions, char *val) {
   char *atoken;
-  char *tokctx;
+  char *tokctx = NULL;
   char *tmpval=strdup(val);
   int   numelt=0;
   cfgoptions->numelt=0;
@@ -214,7 +214,7 @@ int config_process_cmdline(paramdef_t *cfgoptions,int numoptions, char *prefix)
 
     /* first check help options, either --help, -h or --help_<section> */
     if (strncmp(oneargv, "-h",2) == 0 || strncmp(oneargv, "--help",6) == 0 ) {
-      char *tokctx;
+      char *tokctx = NULL;
       pp=strtok_r(oneargv, "_",&tokctx);
       config_get_if()->argv_info[i] |= CONFIG_CMDLINEOPT_PROCESSED;
 

openair2/ENB_APP/CONTROL_MODULES/MAC/flexran_agent_mac_internal.c

@@ -151,6 +151,15 @@ Protocol__FlexranMessage * flexran_agent_generate_diff_mac_stats_report(Protocol
   return msg;
   
  error:
+   if (stats_reply_msg) {
+     if (stats_reply_msg->ue_report) {
+       free(stats_reply_msg->ue_report);
+     }
+     if (stats_reply_msg->cell_report) {
+       free(stats_reply_msg->cell_report);
+     }
+     free(stats_reply_msg);
+   }
    return NULL;
 }
 
@@ -233,6 +242,12 @@ Protocol__FlexUeStatsReport * copy_ue_stats_report(Protocol__FlexUeStatsReport *
   return copy;
 
  error:
+  if (copy){
+    if (copy->bsr){
+      free(copy->bsr);
+    }
+    free(copy);
+  }
   return NULL;
 }
 
@@ -303,6 +318,20 @@ Protocol__FlexUlCqiReport * copy_ul_cqi_report(Protocol__FlexUlCqiReport * origi
   return full_ul_report;
   
   error:
+    if (full_ul_report){
+      if (ul_report){
+        for (i = 0; i < full_ul_report->n_cqi_meas; i++){
+          if (ul_report[i]){
+            if ( ul_report[i]->sinr ){
+              free(ul_report[i]->sinr);
+            }
+            free(ul_report[i]);
+          }
+        }
+        free(ul_report);
+      }
+      free(full_ul_report);
+    }
     return NULL;
 }
 
@@ -369,6 +398,18 @@ Protocol__FlexPagingBufferReport * copy_paging_buffer_report(Protocol__FlexPagin
 
  error:
   /*TODO: free memory properly*/
+  if (copy){
+    if (p_info){
+      for (i = 0; i < copy->n_paging_info; i++){
+        if (p_info[i]){
+          free(p_info[i]);
+        }
+      }
+      free(p_info);
+    }
+    free(copy);
+    copy = NULL;
+  }
   return NULL;
 }
 
@@ -902,6 +943,13 @@ int load_dl_scheduler_function(mid_t mod_id, const char *function_name) {
     LOG_I(FLEXRAN_AGENT, "Scheduler could not be loaded\n");
   }
 
+  if (flexran_agent_get_mac_xface(mod_id)) {
+    if (flexran_agent_get_mac_xface(mod_id)->dl_scheduler_loaded_lib != lib) {
+      dlclose(lib);
+    }
+  } else {
+    dlclose(lib);
+  }
   return 0;
 
  error:

openair2/ENB_APP/CONTROL_MODULES/RRC/flexran_agent_rrc.c

@@ -44,6 +44,8 @@ void flexran_agent_ue_state_change(mid_t mod_id, uint32_t rnti, uint8_t state_ch
   int size;
   Protocol__FlexranMessage *msg = NULL;
   Protocol__FlexHeader *header = NULL;
+  Protocol__FlexUeStateChange *ue_state_change_msg = NULL;
+  Protocol__FlexUeConfig *config = NULL;
   void *data;
   int priority = 0;
   err_code_t err_code=0;
@@ -53,7 +55,6 @@ void flexran_agent_ue_state_change(mid_t mod_id, uint32_t rnti, uint8_t state_ch
   if (flexran_create_header(xid, PROTOCOL__FLEX_TYPE__FLPT_UE_STATE_CHANGE, &header) != 0)
     goto error;
 
-  Protocol__FlexUeStateChange *ue_state_change_msg;
   ue_state_change_msg = malloc(sizeof(Protocol__FlexUeStateChange));
   if(ue_state_change_msg == NULL) {
     goto error;
@@ -62,7 +63,6 @@ void flexran_agent_ue_state_change(mid_t mod_id, uint32_t rnti, uint8_t state_ch
   ue_state_change_msg->has_type = 1;
   ue_state_change_msg->type = state_change;
 
-  Protocol__FlexUeConfig *config;
   config = malloc(sizeof(Protocol__FlexUeConfig));
   if (config == NULL) {
     goto error;
@@ -103,11 +103,24 @@ void flexran_agent_ue_state_change(mid_t mod_id, uint32_t rnti, uint8_t state_ch
   }
 
   LOG_D(FLEXRAN_AGENT,"sent message with size %d\n", size);
+  free(header);
   return;
  error:
   if (err_code != 0)
      LOG_E(FLEXRAN_AGENT, "Could not send UE state message becasue of %d for RNTI %x\n",
            err_code, rnti);
+  if (header){
+    free(header);
+  }
+  if (ue_state_change_msg) {
+    free(ue_state_change_msg);
+  }
+  if (config) {
+    free(config);
+  }
+  if (msg) {
+    free(msg);
+  }
 }
 
 
@@ -405,8 +418,13 @@ int flexran_agent_rrc_stats_reply(mid_t mod_id,
           for (int j = 0; j < neigh_meas->n_eutra_meas; j++ ){
 
               eutra_meas[j] = malloc(sizeof(Protocol__FlexEutraMeasurements));
-              if (eutra_meas[j] == NULL)
+              if (eutra_meas[j] == NULL) {
+                for (int k = 0 ; k < j ; k++) {
+                  free(eutra_meas[k]);
+                }
+                free(eutra_meas);
                 goto error;
+              }
 
               protocol__flex_eutra_measurements__init(eutra_meas[j]);
 

openair2/ENB_APP/enb_config.c

@@ -2572,6 +2572,8 @@ int RCconfig_parallel(void) {
     set_worker_conf(worker_conf);
   }
 
+  free(worker_conf);
+  free(parallel_conf);
   return 0;
 }
 

openair2/ENB_APP/flexran_agent_async.c

@@ -84,6 +84,9 @@ flexran_agent_async_channel_t * flexran_agent_async_channel_info(mid_t mod_id, c
 
  error:
   LOG_I(FLEXRAN_AGENT, "%s(): there was an error\n", __func__);
+  if (channel){
+    free(channel);
+  }
   return NULL;
 }
 

openair2/ENB_APP/flexran_agent_common.c

@@ -514,8 +514,13 @@ int flexran_agent_lc_config_reply(mid_t mod_id, const void *params, Protocol__Fl
     // Fill the config for each UE
     for (int i = 0; i < lc_config_reply_msg->n_lc_ue_config; i++) {
       lc_ue_config[i] = malloc(sizeof(Protocol__FlexLcUeConfig));
-
-      if (!lc_ue_config[i]) goto error;
+      if (!lc_ue_config[i]){
+        for (int j = 0; j < i; j++){
+          free(lc_ue_config[j]);
+        }
+        free(lc_ue_config);
+        goto error;
+      }
 
       protocol__flex_lc_ue_config__init(lc_ue_config[i]);
       const int UE_id = flexran_get_mac_ue_id(mod_id, i);
@@ -527,8 +532,13 @@ int flexran_agent_lc_config_reply(mid_t mod_id, const void *params, Protocol__Fl
 
   *msg = malloc(sizeof(Protocol__FlexranMessage));
 
-  if (*msg == NULL)
+  if (*msg == NULL){
+    for (int k = 0; k < lc_config_reply_msg->n_lc_ue_config; k++){
+      free(lc_ue_config[k]);
+    }
+    free(lc_ue_config);
     goto error;
+  }
 
   protocol__flexran_message__init(*msg);
   (*msg)->msg_case = PROTOCOL__FLEXRAN_MESSAGE__MSG_LC_CONFIG_REPLY_MSG;
@@ -736,7 +746,13 @@ int flexran_agent_enb_config_reply(mid_t mod_id, const void *params, Protocol__F
     for(int i = 0; i < enb_config_reply_msg->n_cell_config; i++) {
       cell_conf[i] = malloc(sizeof(Protocol__FlexCellConfig));
 
-      if (!cell_conf[i]) goto error;
+      if (!cell_conf[i]) {
+        for (int j = 0; j < i; j++) {
+          free(cell_conf[j]);
+        }
+        free(cell_conf);
+        goto error;
+      }
 
       protocol__flex_cell_config__init(cell_conf[i]);
 
@@ -758,8 +774,13 @@ int flexran_agent_enb_config_reply(mid_t mod_id, const void *params, Protocol__F
 
   *msg = malloc(sizeof(Protocol__FlexranMessage));
 
-  if(*msg == NULL)
+  if(*msg == NULL) {
+    for (int k = 0; k < enb_config_reply_msg->n_cell_config; k++) {
+      free(cell_conf[k]);
+    }
+    free(cell_conf);
     goto error;
+  }
 
   protocol__flexran_message__init(*msg);
   (*msg)->msg_case = PROTOCOL__FLEXRAN_MESSAGE__MSG_ENB_CONFIG_REPLY_MSG;
@@ -789,6 +810,8 @@ int flexran_agent_rrc_measurement(mid_t mod_id, const void *params, Protocol__Fl
   Protocol__FlexRrcTriggering *triggering = input->rrc_triggering;
   agent_reconf_rrc *reconf_param = malloc(sizeof(agent_reconf_rrc));
   reconf_param->trigger_policy = triggering->rrc_trigger;
+  reconf_param->report_interval = 0;
+  reconf_param->report_amount = 0;
   struct rrc_eNB_ue_context_s   *ue_context_p = NULL;
   RB_FOREACH(ue_context_p, rrc_ue_tree_s, &(RC.rrc[mod_id]->rrc_ue_head)) {
     PROTOCOL_CTXT_SET_BY_MODULE_ID(&ctxt, mod_id, ENB_FLAG_YES, ue_context_p->ue_context.rnti, flexran_get_current_frame(mod_id), flexran_get_current_subframe (mod_id), mod_id);

openair2/ENB_APP/flexran_agent_handler.c

@@ -293,7 +293,7 @@ int flexran_agent_handle_stats(mid_t mod_id, const void *params, Protocol__Flexr
       /* Check if request was periodical */
       if (comp_req->report_frequency == PROTOCOL__FLEX_STATS_REPORT_FREQ__FLSRF_PERIODICAL) {
         /* Create a one off flexran message as an argument for the periodical task */
-        Protocol__FlexranMessage *timer_msg;
+        Protocol__FlexranMessage *timer_msg = NULL;
         stats_request_config_t request_config;
         request_config.report_type = PROTOCOL__FLEX_STATS_TYPE__FLST_COMPLETE_STATS;
         request_config.report_frequency = PROTOCOL__FLEX_STATS_REPORT_FREQ__FLSRF_ONCE;
@@ -311,7 +311,10 @@ int flexran_agent_handle_stats(mid_t mod_id, const void *params, Protocol__Flexr
            report_config.ue_report_type[0].ue_report_flags = ue_flags;
         }
         request_config.config = &report_config;
-        flexran_agent_stats_request(enb_id, xid, &request_config, &timer_msg);
+        if (flexran_agent_stats_request(enb_id, xid, &request_config, &timer_msg) == -1) {
+          err_code = -100;
+          goto error;
+        }
         /* Create a timer */
         long timer_id = 0;
         flexran_agent_timer_args_t *timer_args = malloc(sizeof(flexran_agent_timer_args_t));
@@ -420,19 +423,21 @@ int flexran_agent_handle_stats(mid_t mod_id, const void *params, Protocol__Flexr
 int flexran_agent_stats_reply(mid_t enb_id, xid_t xid, const report_config_t *report_config, Protocol__FlexranMessage **msg){
 
   Protocol__FlexHeader *header = NULL;
-  err_code_t err_code;
-  int i;
+  Protocol__FlexUeStatsReport **ue_report = NULL;
+  Protocol__FlexCellStatsReport **cell_report = NULL;
+  Protocol__FlexStatsReply *stats_reply_msg = NULL;
+  err_code_t err_code = PROTOCOL__FLEXRAN_ERR__UNEXPECTED;
+  int i,j;
 
-  if (flexran_create_header(xid, PROTOCOL__FLEX_TYPE__FLPT_STATS_REPLY, &header) != 0)
+  if (flexran_create_header(xid, PROTOCOL__FLEX_TYPE__FLPT_STATS_REPLY, &header) != 0) {
     goto error;
-
-  
-  Protocol__FlexStatsReply *stats_reply_msg;
+  }
 
   stats_reply_msg = malloc(sizeof(Protocol__FlexStatsReply));
 
-  if (stats_reply_msg == NULL)
+  if (stats_reply_msg == NULL) {
     goto error;
+  }
 
   protocol__flex_stats_reply__init(stats_reply_msg);
   stats_reply_msg->header = header;
@@ -442,16 +447,18 @@ int flexran_agent_stats_reply(mid_t enb_id, xid_t xid, const report_config_t *re
 
   // UE report
 
-  Protocol__FlexUeStatsReport **ue_report;
-  
-
   ue_report = malloc(sizeof(Protocol__FlexUeStatsReport *) * report_config->nr_ue);
-          if (ue_report == NULL)
-            goto error;
+
+  if (ue_report == NULL) {
+    goto error;
+  }
   
   for (i = 0; i < report_config->nr_ue; i++) {
 
       ue_report[i] = malloc(sizeof(Protocol__FlexUeStatsReport));
+      if (ue_report[i] == NULL) {
+        goto error;
+      }
       protocol__flex_ue_stats_report__init(ue_report[i]);
       ue_report[i]->rnti = report_config->ue_report_type[i].ue_rnti;
       ue_report[i]->has_rnti = 1;
@@ -460,19 +467,18 @@ int flexran_agent_stats_reply(mid_t enb_id, xid_t xid, const report_config_t *re
   }
 
   // cell rpoert 
-
-  Protocol__FlexCellStatsReport **cell_report;
-
   
   cell_report = malloc(sizeof(Protocol__FlexCellStatsReport *) * report_config->nr_cc);
-  if (cell_report == NULL)
+  if (cell_report == NULL) {
     goto error;
+  }
   
   for (i = 0; i < report_config->nr_cc; i++) {
 
       cell_report[i] = malloc(sizeof(Protocol__FlexCellStatsReport));
-      if(cell_report[i] == NULL)
+      if(cell_report[i] == NULL) {
           goto error;
+      }
 
       protocol__flex_cell_stats_report__init(cell_report[i]);
       cell_report[i]->carrier_index = report_config->cc_report_type[i].cc_id;
@@ -507,8 +513,9 @@ int flexran_agent_stats_reply(mid_t enb_id, xid_t xid, const report_config_t *re
   stats_reply_msg->ue_report = ue_report;
 
  *msg = malloc(sizeof(Protocol__FlexranMessage));
-  if(*msg == NULL)
+  if(*msg == NULL) {
     goto error;
+  }
   protocol__flexran_message__init(*msg);
   (*msg)->msg_case = PROTOCOL__FLEXRAN_MESSAGE__MSG_STATS_REPLY_MSG;
   (*msg)->msg_dir =  PROTOCOL__FLEXRAN_DIRECTION__SUCCESSFUL_OUTCOME;
@@ -518,8 +525,38 @@ int flexran_agent_stats_reply(mid_t enb_id, xid_t xid, const report_config_t *re
 
 error :
   LOG_E(FLEXRAN_AGENT, "errno %d occured\n", err_code);
-  return err_code;
 
+  if (header != NULL) {
+    free(header);
+    header = NULL;
+  }
+
+  if (stats_reply_msg != NULL) {
+    free(stats_reply_msg);
+    stats_reply_msg = NULL;
+  }
+
+  if (ue_report != NULL) {
+    for (j = 0; j < report_config->nr_ue; j++) {
+      if (ue_report[j] != NULL) {
+        free(ue_report[j]);
+      }
+    }
+    free(ue_report);
+    ue_report = NULL;
+  }
+
+  if (cell_report != NULL) {
+    for (j = 0; j < report_config->nr_cc; j++) {
+      if (cell_report[j] != NULL) {
+        free(cell_report[j]);
+      }
+    }
+    free(cell_report);
+    cell_report = NULL;
+  }
+
+  return err_code;
 }
 
 /*
@@ -705,7 +742,7 @@ err_code_t flexran_agent_enable_cont_stats_update(mid_t mod_id,
     goto error;
   }
 
-  Protocol__FlexranMessage *req_msg;
+  Protocol__FlexranMessage *req_msg = NULL;
 
   flexran_agent_stats_request(mod_id, xid, stats_req, &req_msg);
   stats_context[mod_id].stats_req = req_msg;

openair2/F1AP/f1ap_common.c

@@ -177,7 +177,7 @@ int f1ap_du_add_cu_ue_id(f1ap_cudu_inst_t *f1_inst,
                          module_id_t       du_ue_f1ap_id,
                          module_id_t       cu_ue_f1ap_id) {
   module_id_t f1ap_uid = f1ap_get_du_uid(f1_inst,du_ue_f1ap_id);
-  if (f1ap_uid < 0) return -1;
+  if (f1ap_uid < 0 || f1ap_uid >= MAX_MOBILES_PER_ENB) return -1;
   f1_inst->f1ap_ue[f1ap_uid].cu_ue_f1ap_id = cu_ue_f1ap_id;
   LOG_I(F1AP, "Adding cu_ue_f1ap_id %d for UE with RNTI %x\n", cu_ue_f1ap_id, f1_inst->f1ap_ue[f1ap_uid].rnti);
   return 0;
@@ -187,7 +187,7 @@ int f1ap_cu_add_du_ue_id(f1ap_cudu_inst_t *f1_inst,
                          module_id_t       cu_ue_f1ap_id,
                          module_id_t       du_ue_f1ap_id) {
   module_id_t f1ap_uid = f1ap_get_cu_uid(f1_inst,cu_ue_f1ap_id);
-  if (f1ap_uid < 0) return -1;
+  if (f1ap_uid < 0 || f1ap_uid >= MAX_MOBILES_PER_ENB) return -1;
   f1_inst->f1ap_ue[f1ap_uid].du_ue_f1ap_id = du_ue_f1ap_id;
   LOG_I(F1AP, "Adding du_ue_f1ap_id %d for UE with RNTI %x\n", du_ue_f1ap_id, f1_inst->f1ap_ue[f1ap_uid].rnti);
   return 0;

openair2/F1AP/f1ap_cu_interface_management.c

@@ -327,6 +327,7 @@ int CU_send_F1_SETUP_RESPONSE(instance_t instance,
 
     /* - nRCGI */
     F1AP_NRCGI_t nRCGI;
+    memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
     MCC_MNC_TO_PLMNID(f1ap_setup_resp->mcc[i], f1ap_setup_resp->mnc[i], f1ap_setup_resp->mnc_digit_length[i],
                                      &nRCGI.pLMN_Identity);
     NR_CELL_ID_TO_BIT_STRING(f1ap_setup_resp->nr_cellid[i], &nRCGI.nRCellIdentity);
@@ -562,6 +563,7 @@ int CU_send_gNB_CU_CONFIGURATION_UPDATE(instance_t instance, module_id_t du_mod_
 
      /* - nRCGI */
      F1AP_NRCGI_t nRCGI;
+     memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
      MCC_MNC_TO_PLMNID(mcc, mnc, mnc_digit_length,
                                          &nRCGI.pLMN_Identity);
      NR_CELL_ID_TO_BIT_STRING(123456, &nRCGI.nRCellIdentity);
@@ -611,6 +613,7 @@ int CU_send_gNB_CU_CONFIGURATION_UPDATE(instance_t instance, module_id_t du_mod_
 
        /* - nRCGI */
        F1AP_NRCGI_t nRCGI;
+       memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
        MCC_MNC_TO_PLMNID(mcc, mnc, mnc_digit_length,
                                            &nRCGI.pLMN_Identity);
        NR_CELL_ID_TO_BIT_STRING(123456, &nRCGI.nRCellIdentity);
@@ -787,6 +790,7 @@ int CU_send_gNB_CU_CONFIGURATION_UPDATE(instance_t instance, module_id_t du_mod_
 
        /* - nRCGI */
        F1AP_NRCGI_t nRCGI;
+       memset(&nRCGI,0,sizeof(F1AP_NRCGI_t));
        MCC_MNC_TO_PLMNID(mcc, mnc, mnc_digit_length,
                                            &nRCGI.pLMN_Identity);
        NR_CELL_ID_TO_BIT_STRING(123456, &nRCGI.nRCellIdentity);

openair2/F1AP/f1ap_cu_ue_context_management.c

@@ -95,6 +95,7 @@ int CU_send_UE_CONTEXT_SETUP_REQUEST(instance_t instance,
   ie->value.present                  = F1AP_UEContextSetupRequestIEs__value_PR_NRCGI;
   /* - nRCGI */
   F1AP_NRCGI_t nRCGI;
+  memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
   MCC_MNC_TO_PLMNID(f1ap_ue_context_setup_req->mcc,
                     f1ap_ue_context_setup_req->mnc,
                     f1ap_ue_context_setup_req->mnc_digit_length,
@@ -1183,6 +1184,7 @@ int CU_send_UE_CONTEXT_MODIFICATION_REQUEST(instance_t instance) {
 
   //   /* - sCell_ID */
      F1AP_NRCGI_t nRCGI;
+     memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
      MCC_MNC_TO_PLMNID(mcc, mnc, mnc_digit_length,
                                         &nRCGI.pLMN_Identity);
      NR_CELL_ID_TO_BIT_STRING(123456, &nRCGI.nRCellIdentity);
@@ -1222,6 +1224,7 @@ int CU_send_UE_CONTEXT_MODIFICATION_REQUEST(instance_t instance) {
 
      /* - sCell_ID */
      F1AP_NRCGI_t nRCGI;
+     memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
      MCC_MNC_TO_PLMNID(mcc, mnc, mnc_digit_length,
                                         &nRCGI.pLMN_Identity);
      NR_CELL_ID_TO_BIT_STRING(123456, &nRCGI.nRCellIdentity);

openair2/F1AP/f1ap_du_interface_management.c

@@ -169,6 +169,7 @@ int DU_send_F1_SETUP_REQUEST(instance_t instance) {
 
         /* - nRCGI */
         F1AP_NRCGI_t nRCGI;
+        memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
         MCC_MNC_TO_PLMNID(f1ap_du_data->mcc[i], f1ap_du_data->mnc[i], f1ap_du_data->mnc_digit_length[i], &nRCGI.pLMN_Identity);
         LOG_D(F1AP, "plmn: (%d,%d)\n",f1ap_du_data->mcc[i],f1ap_du_data->mnc[i]);
         //MCC_MNC_TO_PLMNID(208, 95, 2, &nRCGI.pLMN_Identity);
@@ -619,6 +620,7 @@ int DU_send_gNB_DU_CONFIGURATION_UPDATE(instance_t instance,
         memset((void *)&served_cell_information, 0, sizeof(F1AP_Served_Cell_Information_t));
         /* - nRCGI */
         F1AP_NRCGI_t nRCGI;
+        memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
         MCC_MNC_TO_PLMNID(f1ap_setup_req->mcc[i], f1ap_setup_req->mnc[i], f1ap_setup_req->mnc_digit_length[i], &nRCGI.pLMN_Identity);
         LOG_D(F1AP, "nr_cellId : %x %x %x %x %x\n",
               nRCGI.nRCellIdentity.buf[0],
@@ -778,6 +780,7 @@ int DU_send_gNB_DU_CONFIGURATION_UPDATE(instance_t instance,
 
         /* 3.1 oldNRCGI */
         F1AP_NRCGI_t oldNRCGI;
+        memset(&oldNRCGI, 0, sizeof(F1AP_NRCGI_t));
         MCC_MNC_TO_PLMNID(f1ap_setup_req->mcc[i], f1ap_setup_req->mnc[i], f1ap_setup_req->mnc_digit_length[i],
                                          &oldNRCGI.pLMN_Identity);
         NR_CELL_ID_TO_BIT_STRING(f1ap_setup_req->nr_cellid[i], &oldNRCGI.nRCellIdentity);
@@ -790,6 +793,7 @@ int DU_send_gNB_DU_CONFIGURATION_UPDATE(instance_t instance,
 
         /* - nRCGI */
         F1AP_NRCGI_t nRCGI;
+        memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
         MCC_MNC_TO_PLMNID(f1ap_setup_req->mcc[i], f1ap_setup_req->mnc[i], f1ap_setup_req->mnc_digit_length[i],
                                          &nRCGI.pLMN_Identity);
         NR_CELL_ID_TO_BIT_STRING(f1ap_setup_req->nr_cellid[i], &nRCGI.nRCellIdentity);
@@ -944,6 +948,7 @@ int DU_send_gNB_DU_CONFIGURATION_UPDATE(instance_t instance,
 
         /* 3.1 oldNRCGI */
         F1AP_NRCGI_t oldNRCGI;
+        memset(&oldNRCGI, 0, sizeof(F1AP_NRCGI_t));
         MCC_MNC_TO_PLMNID(f1ap_setup_req->mcc[i], f1ap_setup_req->mnc[i], f1ap_setup_req->mnc_digit_length[i],
                                          &oldNRCGI.pLMN_Identity);
         NR_CELL_ID_TO_BIT_STRING(f1ap_setup_req->nr_cellid[i], &oldNRCGI.nRCellIdentity);
@@ -980,6 +985,7 @@ int DU_send_gNB_DU_CONFIGURATION_UPDATE(instance_t instance,
 
         /* 3.1 oldNRCGI */
         F1AP_NRCGI_t nRCGI;
+        memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
         MCC_MNC_TO_PLMNID(f1ap_setup_req->mcc[i], f1ap_setup_req->mnc[i], f1ap_setup_req->mnc_digit_length[i],
                                          &nRCGI.pLMN_Identity);
         NR_CELL_ID_TO_BIT_STRING(f1ap_setup_req->nr_cellid[i], &nRCGI.nRCellIdentity);

openair2/F1AP/f1ap_du_rrc_message_transfer.c

@@ -799,6 +799,7 @@ int DU_send_INITIAL_UL_RRC_MESSAGE_TRANSFER(module_id_t     module_idP,
   ie->value.present                  = F1AP_InitialULRRCMessageTransferIEs__value_PR_NRCGI;
 
   F1AP_NRCGI_t nRCGI;
+  memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
   MCC_MNC_TO_PLMNID(f1ap_du_data->mcc[0], f1ap_du_data->mnc[0], f1ap_du_data->mnc_digit_length[0],
                                          &nRCGI.pLMN_Identity);
   NR_CELL_ID_TO_BIT_STRING(f1ap_du_data->nr_cellid[0], &nRCGI.nRCellIdentity);

openair2/F1AP/f1ap_du_ue_context_management.c

@@ -470,6 +470,7 @@ int DU_send_UE_CONTEXT_SETUP_RESPONSE(instance_t instance) {
 
       /* sCell_ID */
       F1AP_NRCGI_t nRCGI;  // issue here
+      memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
       MCC_MNC_TO_PLMNID(f1ap_du_data->mcc[i], f1ap_du_data->mnc[i], f1ap_du_data->mnc_digit_length[i], &nRCGI.pLMN_Identity);
 
       NR_CELL_ID_TO_BIT_STRING(f1ap_du_data->nr_cellid[0], &nRCGI.nRCellIdentity);
@@ -1155,6 +1156,7 @@ int DU_send_UE_CONTEXT_MODIFICATION_RESPONSE(instance_t instance) {
 
      /* - sCell_ID */
      F1AP_NRCGI_t nRCGI;
+     memset(&nRCGI, 0, sizeof(F1AP_NRCGI_t));
      MCC_MNC_TO_PLMNID(f1ap_du_data->mcc[i], f1ap_du_data->mnc[i], f1ap_du_data->mnc_digit_length[i],
                                         &nRCGI.pLMN_Identity);
 

openair2/F1AP/f1ap_handlers.c

@@ -98,7 +98,7 @@ int f1ap_handle_message(instance_t instance, uint32_t assoc_id, int32_t stream,
   }
 
   /* Checking procedure Code and direction of message */
-  if (pdu.choice.initiatingMessage->procedureCode > sizeof(f1ap_messages_callback) / (3 * sizeof(
+  if (pdu.choice.initiatingMessage->procedureCode >= sizeof(f1ap_messages_callback) / (3 * sizeof(
         f1ap_message_decoded_callback))
       || (pdu.present > F1AP_F1AP_PDU_PR_unsuccessfulOutcome)) {
     LOG_E(F1AP, "[SCTP %d] Either procedureCode %ld or direction %d exceed expected\n",

openair2/LAYER2/MAC/pre_processor.c

@@ -1399,7 +1399,6 @@ dlsch_scheduler_pre_processor_reset(module_id_t module_idP,
 
   //
   for (CC_id = 0; CC_id < RC.nb_mac_CC[module_idP]; CC_id++) {
-    LOG_D(MAC, "Running preprocessor for UE %d (%x)\n", UE_id,(int)(UE_RNTI(module_idP, UE_id)));
     // initialize harq_pid and round
     cc = &RC.mac[module_idP]->common_channels[CC_id];
     N_RBG[CC_id] = to_rbg(cc->mib->message.dl_Bandwidth);

openair2/LAYER2/PDCP_v10.1.0/pdcp_fifo.c

@@ -499,7 +499,7 @@ void pdcp_fifo_read_input_sdus_frompc5s (const protocol_ctxt_t *const  ctxt_pP)
   (void)data_p;
   pdcp_t                        *pdcp_p    = NULL;
   //TTN for D2D (PC5S)
-  int prose_addr_len;
+  int prose_addr_len = sizeof(prose_pdcp_addr);
   char send_buf[BUFSIZE], receive_buf[BUFSIZE];
   //int optval;
   int bytes_received;

openair2/LAYER2/RLC/UM_v9.3.0/rlc_um_dar.c

@@ -112,7 +112,7 @@ signed int rlc_um_get_pdu_infos(
       //             PROTOCOL_RLC_UM_CTXT_FMT"[GET PDU INFO]  SN %04d TOO MANY LIs ",
       //             PROTOCOL_RLC_UM_CTXT_ARGS(ctxt_pP, rlc_pP),
       //             pdu_info_pP->sn);
-      if(pdu_info_pP->num_li > RLC_UM_SEGMENT_NB_MAX_LI_PER_PDU) {
+      if(pdu_info_pP->num_li >= RLC_UM_SEGMENT_NB_MAX_LI_PER_PDU) {
         LOG_E(RLC, PROTOCOL_RLC_UM_CTXT_FMT"[GET PDU INFO]  SN %04d TOO MANY LIs \n",
                    PROTOCOL_RLC_UM_CTXT_ARGS(ctxt_pP, rlc_pP),
                    pdu_info_pP->sn);

openair2/RRC/LTE/rrc_eNB.c

@@ -3915,6 +3915,27 @@ flexran_rrc_eNB_generate_defaultRRCConnectionReconfiguration(const protocol_ctxt
     size,
     buffer,
     PDCP_TRANSMISSION_MODE_CONTROL);
+
+  free(quantityConfig->quantityConfigEUTRA->filterCoefficientRSRQ);
+  quantityConfig->quantityConfigEUTRA->filterCoefficientRSRQ = NULL;
+
+  free(quantityConfig->quantityConfigEUTRA->filterCoefficientRSRP);
+  quantityConfig->quantityConfigEUTRA->filterCoefficientRSRP = NULL;
+
+  free(quantityConfig->quantityConfigEUTRA);
+  quantityConfig->quantityConfigEUTRA = NULL;
+
+  free(quantityConfig);
+  quantityConfig = NULL;
+
+  free(mac_MainConfig->ul_SCH_Config);
+  mac_MainConfig->ul_SCH_Config = NULL;
+
+  free(mac_MainConfig->phr_Config);
+  mac_MainConfig->phr_Config = NULL;
+
+  free(mac_MainConfig);
+  mac_MainConfig = NULL;
 }
 
 
@@ -7736,9 +7757,9 @@ void *rrc_enb_process_itti_msg(void *notUsed) {
             &ctxt,
             RRC_MAC_CCCH_DATA_IND(msg_p).sdu_size);
 
-      if (RRC_MAC_CCCH_DATA_IND(msg_p).sdu_size >= RRC_BUFFER_SIZE_MAX) {
+      if (RRC_MAC_CCCH_DATA_IND(msg_p).sdu_size >= CCCH_SDU_SIZE) {
         LOG_I(RRC, "CCCH message has size %d > %d\n",
-              RRC_MAC_CCCH_DATA_IND(msg_p).sdu_size,RRC_BUFFER_SIZE_MAX);
+              RRC_MAC_CCCH_DATA_IND(msg_p).sdu_size,CCCH_SDU_SIZE);
         break;
       }
 
@@ -8154,7 +8175,7 @@ rrc_eNB_generate_RRCConnectionReconfiguration_Sidelink(
 //-----------------------------------------------------------------------------
 {
   uint8_t                             buffer[RRC_BUF_SIZE];
-  uint16_t                            size = -1;
+  uint16_t                            size = 0;
   memset(buffer, 0, RRC_BUF_SIZE);
 
   // allocate dedicated pools for UE -sl-CommConfig/sl-DiscConfig (sl-V2X-ConfigDedicated)
@@ -8291,6 +8312,7 @@ LTE_SL_CommConfig_r12_t rrc_eNB_get_sidelink_commTXPool( const protocol_ctxt_t *
 LTE_SL_DiscConfig_r12_t rrc_eNB_get_sidelink_discTXPool( const protocol_ctxt_t *const ctxt_pP, rrc_eNB_ue_context_t *const ue_context_pP,  int n_discoveryMessages ) {
   //TODO
   LTE_SL_DiscConfig_r12_t  sl_DiscConfig;
+  memset(&sl_DiscConfig,0,sizeof(LTE_SL_DiscConfig_r12_t));
   sl_DiscConfig.discTxResources_r12 = CALLOC(1,sizeof(*sl_DiscConfig.discTxResources_r12));
   sl_DiscConfig.discTxResources_r12->present = LTE_SL_DiscConfig_r12__discTxResources_r12_PR_setup;
   sl_DiscConfig.discTxResources_r12->choice.setup.present = LTE_SL_DiscConfig_r12__discTxResources_r12__setup_PR_scheduled_r12;

openair2/RRC/LTE/rrc_eNB_S1AP.c

@@ -846,6 +846,7 @@ rrc_eNB_process_S1AP_DOWNLINK_NAS(
   uint8_t srb_id;
   struct rrc_eNB_ue_context_s *ue_context_p = NULL;
   protocol_ctxt_t              ctxt;
+  memset(&ctxt, 0, sizeof(protocol_ctxt_t));
   ue_initial_id = S1AP_DOWNLINK_NAS (msg_p).ue_initial_id;
   eNB_ue_s1ap_id = S1AP_DOWNLINK_NAS (msg_p).eNB_ue_s1ap_id;
   ue_context_p = rrc_eNB_get_ue_context_from_s1ap_ids(instance, ue_initial_id, eNB_ue_s1ap_id);

openair2/UTIL/ASYNC_IF/socket_link.c

@@ -228,7 +228,7 @@ socket_link_t *new_link_udp_client(const char *server, int port){
 
   struct sockaddr_in si_other;
   int s;
-  socklen_t slen;
+  socklen_t slen = sizeof(si_other);
  
   if ( (s=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1){
         goto error;
@@ -402,7 +402,7 @@ static int socket_udp_receive(int socket_fd, void *buf, int size)
   LOG_D(PROTO_AGENT,"UDP RECEIVE\n");
 
   struct sockaddr_in client;
-  socklen_t slen;
+  socklen_t slen = sizeof(client);
   int   l;
 
   l = recvfrom(socket_fd, buf, size, 0, (struct sockaddr *) &client, &slen);

openair2/X2AP/x2ap_eNB_handler.c

@@ -192,7 +192,7 @@ int x2ap_eNB_handle_message(instance_t instance, uint32_t assoc_id, int32_t stre
 
   case X2AP_X2AP_PDU_PR_initiatingMessage:
     /* Checking procedure Code and direction of message */
-    if (pdu.choice.initiatingMessage.procedureCode > sizeof(x2ap_messages_callback) / (3 * sizeof(
+    if (pdu.choice.initiatingMessage.procedureCode >= sizeof(x2ap_messages_callback) / (3 * sizeof(
           x2ap_message_decoded_callback))) {
         //|| (pdu.present > X2AP_X2AP_PDU_PR_unsuccessfulOutcome)) {
       X2AP_ERROR("[SCTP %d] Either procedureCode %ld exceed expected\n",
@@ -218,7 +218,7 @@ int x2ap_eNB_handle_message(instance_t instance, uint32_t assoc_id, int32_t stre
 
   case X2AP_X2AP_PDU_PR_successfulOutcome:
     /* Checking procedure Code and direction of message */
-    if (pdu.choice.successfulOutcome.procedureCode > sizeof(x2ap_messages_callback) / (3 * sizeof(
+    if (pdu.choice.successfulOutcome.procedureCode >= sizeof(x2ap_messages_callback) / (3 * sizeof(
           x2ap_message_decoded_callback))) {
         //|| (pdu.present > X2AP_X2AP_PDU_PR_unsuccessfulOutcome)) {
       X2AP_ERROR("[SCTP %d] Either procedureCode %ld exceed expected\n",
@@ -244,7 +244,7 @@ int x2ap_eNB_handle_message(instance_t instance, uint32_t assoc_id, int32_t stre
 
   case X2AP_X2AP_PDU_PR_unsuccessfulOutcome:
     /* Checking procedure Code and direction of message */
-    if (pdu.choice.unsuccessfulOutcome.procedureCode > sizeof(x2ap_messages_callback) / (3 * sizeof(
+    if (pdu.choice.unsuccessfulOutcome.procedureCode >= sizeof(x2ap_messages_callback) / (3 * sizeof(
           x2ap_message_decoded_callback))) {
         //|| (pdu.present > X2AP_X2AP_PDU_PR_unsuccessfulOutcome)) {
       X2AP_ERROR("[SCTP %d] Either procedureCode %ld exceed expected\n",

openair3/GTPV1-U/gtpv1u_eNB.c

@@ -986,7 +986,7 @@ void *gtpv1u_eNB_process_itti_msg(void *notUsed) {
       if (hash_rc == HASH_TABLE_KEY_NOT_EXISTS) {
         LOG_E(GTPU, "nwGtpv1uProcessUlpReq failed: while getting ue rnti %x in hashtable ue_mapping\n", data_req_p->rnti);
       } else {
-        if ((data_req_p->rab_id >= GTPV1U_BEARER_OFFSET) && (data_req_p->rab_id <= max_val_LTE_DRB_Identity)) {
+        if ((data_req_p->rab_id >= GTPV1U_BEARER_OFFSET) && (data_req_p->rab_id < max_val_LTE_DRB_Identity)) {
           enb_s1u_teid                        = gtpv1u_ue_data_p->bearers[data_req_p->rab_id - GTPV1U_BEARER_OFFSET].teid_eNB;
           sgw_s1u_teid                        = gtpv1u_ue_data_p->bearers[data_req_p->rab_id - GTPV1U_BEARER_OFFSET].teid_sgw;
           stack_req.apiType                   = NW_GTPV1U_ULP_API_SEND_TPDU;

openair3/S1AP/s1ap_eNB_handlers.c

@@ -220,7 +220,7 @@ int s1ap_eNB_handle_message(uint32_t assoc_id, int32_t stream,
   }
 
   /* Checking procedure Code and direction of message */
-  if (pdu.choice.initiatingMessage.procedureCode > sizeof(messages_callback) / (3 * sizeof(
+  if (pdu.choice.initiatingMessage.procedureCode >= sizeof(messages_callback) / (3 * sizeof(
         s1ap_message_decoded_callback))
       || (pdu.present > S1AP_S1AP_PDU_PR_unsuccessfulOutcome)) {
     S1AP_ERROR("[SCTP %d] Either procedureCode %ld or direction %d exceed expected\n",

targets/RT/USER/lte-ru.c

@@ -678,6 +678,7 @@ static void *emulatedRF_thread(void *param) {
   req.tv_sec = 0;
   req.tv_nsec = (numerology>0)? ((microsec * 1000L)/numerology):(microsec * 1000L)*2;
   cpu_set_t cpuset;
+  CPU_ZERO(&cpuset);
   CPU_SET(1,&cpuset);
   pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
   int policy;

targets/RT/USER/lte-softmodem.c

@@ -618,6 +618,8 @@ int main( int argc, char **argv ) {
     ctxt.instance = 0;
     ctxt.rnti = 0;
     ctxt.enb_flag = 1;
+    ctxt.frame = 0;
+    ctxt.subframe = 0;
     pdcp_run(&ctxt);
   }