Error checking for processing DL PDUs

Also, we only should be handling/generating AM
PDUs in the PDCP/RLC layer, not UM PDUs. Updated
the pre-configuration settings. This seemed to
make the uplink traffic work (meaning it gets
from NR UE to the gNB to the EPC). Woo! Still
working on the downlink.

openair2/LAYER2/NR_MAC_UE/nr_ue_procedures.c

@@ -3334,14 +3334,21 @@ void nr_ue_process_mac_pdu(nr_downlink_indication_t *dl_info,
                 //  check if LCID is valid at current time.
 
             default:
+            {
                 //  check if LCID is valid at current time.
-                if(((NR_MAC_SUBHEADER_SHORT *)pduP)->F){
+                if (pdu_len < sizeof(NR_MAC_SUBHEADER_SHORT))
+                  return;
+                NR_MAC_SUBHEADER_SHORT *shs = (NR_MAC_SUBHEADER_SHORT *)pduP;
+                if (shs->F) {
                     //mac_sdu_len |= (uint16_t)(((NR_MAC_SUBHEADER_LONG *)pduP)->L2)<<8;
                     mac_subheader_len = 3;
-                    mac_sdu_len = ((uint16_t)(((NR_MAC_SUBHEADER_LONG *) pduP)->L1 & 0x7f) << 8)
-                    | ((uint16_t)((NR_MAC_SUBHEADER_LONG *) pduP)->L2 & 0xff);
-
+                    if (pdu_len < sizeof(NR_MAC_SUBHEADER_LONG))
+                      return;
+                    NR_MAC_SUBHEADER_LONG *shl = (NR_MAC_SUBHEADER_LONG *)pduP;
+                    mac_sdu_len = ((uint16_t)(shl->L1 & 0x7f) << 8) | (uint16_t)(shl->L2 & 0xff);
                 } else {
+                  if (pdu_len < sizeof(NR_MAC_SUBHEADER_SHORT))
+                    return;
                   mac_sdu_len = (uint16_t)((NR_MAC_SUBHEADER_SHORT *)pduP)->L;
                   mac_subheader_len = 2;
                 }
@@ -3377,6 +3384,7 @@ void nr_ue_process_mac_pdu(nr_downlink_indication_t *dl_info,
 
             break;
             }
+        }
         pduP += ( mac_subheader_len + mac_ce_len + mac_sdu_len );
         pdu_len -= ( mac_subheader_len + mac_ce_len + mac_sdu_len );
         if (pdu_len < 0)

openair2/LAYER2/nr_pdcp/nr_pdcp_oai_api.c

@@ -1023,7 +1023,7 @@ void nr_DRB_preconfiguration(uint16_t crnti)
 
   NR_RLC_BearerConfig_t *RLC_BearerConfig = calloc(1,sizeof(*RLC_BearerConfig));
   nr_rlc_bearer_init(RLC_BearerConfig,NR_RLC_BearerConfig__servedRadioBearer_PR_drb_Identity);
-  nr_drb_config(RLC_BearerConfig->rlc_Config, NR_RLC_Config_PR_um_Bi_Directional);
+  nr_drb_config(RLC_BearerConfig->rlc_Config, NR_RLC_Config_PR_am);
   nr_rlc_bearer_init_ul_spec(RLC_BearerConfig->mac_LogicalChannelConfig);
 
   Rlc_Bearer_ToAdd_list = calloc(1,sizeof(*Rlc_Bearer_ToAdd_list));