Scan build: Result of operation is garbage or undefined

common/utils/nr/nr_common.h

@@ -214,10 +214,6 @@ void nr_est_delay(int ofdm_symbol_size, const c16_t *ls_est, c16_t *ch_estimates
 #define CEILIDIV(a,b) ((a+b-1)/b)
 #define ROUNDIDIV(a,b) (((a<<1)+b)/(b<<1))
 
-#define cmax(a,b)  ((a>b) ? (a) : (b))
-#define cmax3(a,b,c) ((cmax(a,b)>c) ? (cmax(a,b)) : (c))
-#define cmin(a,b)  ((a<b) ? (a) : (b))
-
 #ifdef __cplusplus
 #ifdef min
 #undef min

common/utils/utils.h

@@ -19,9 +19,21 @@ extern "C" {
 
 #define sizeofArray(a) (sizeof(a)/sizeof(*(a)))
 
-#define cmax(a,b)  ((a>b) ? (a) : (b))
-#define cmax3(a,b,c) ((cmax(a,b)>c) ? (cmax(a,b)) : (c))
-#define cmin(a,b)  ((a<b) ? (a) : (b))
+// Prevent double evaluation in max macro
+#define cmax(a,b) ({ __typeof__ (a) _a = (a); \
+                     __typeof__ (b) _b = (b); \
+                     _a > _b ? _a : _b; })
+
+
+#define cmax3(a,b,c) ( cmax(cmax(a,b), cmax(b,c)) )  
+
+// Prevent double evaluation in min macro
+#define cmin(a,b) ({ __typeof__ (a) _a = (a); \
+                     __typeof__ (b) _b = (b); \
+                     _a < _b ? _a : _b; })
+
+
+
 
 #ifdef __cplusplus
 #ifdef min

openair1/PHY/CODING/nrLDPC_encoder/ldpc_encoder.c

@@ -171,6 +171,7 @@ int LDPCencoder(unsigned char **inputArray, unsigned char **outputArray, encoder
       {
         fprintf(fd,"\n//row: %d\n",i1);
         fprintf(fd2,"\n//row: %d\n",i1);
+        AssertFatal(shift > 0 , "The result of the right shift is undefined because the right operand is negative\n");
 	fprintf(fd,"     d2[%d]=",(Zc*i1)>>shift);
 	fprintf(fd2,"     d2[%d]=",(Zc*i1)>>(shift-1));
 

openair1/PHY/CODING/nrPolar_tools/nr_polar_decoder.c

@@ -116,6 +116,7 @@ int8_t polar_decoder(double *input,
   }
 
   //The index of the last 1-valued bit that appears in each column.
+  AssertFatal(polarParams->crcParityBits > 0, "UB for VLA"); 
   uint16_t last1ind[polarParams->crcParityBits];
 
   for (int j=0; j<polarParams->crcParityBits; j++) {

openair1/PHY/CODING/nrPolar_tools/nr_polar_procedures.c

@@ -239,7 +239,7 @@ void nr_polar_info_bit_pattern(uint8_t *ibp,
 {
   int Q_Ftmp_N[N + 1]; // Last element shows the final
   int Q_Itmp_N[N + 1]; // array index assigned a value.
-
+                       
   for (int i = 0; i <= N; i++) {
     Q_Ftmp_N[i] = -1; // Empty array.
     Q_Itmp_N[i] = -1;
@@ -282,11 +282,13 @@ void nr_polar_info_bit_pattern(uint8_t *ibp,
   // Q_I,tmp_N = Q_0_N-1 \ Q_F,tmp_N
   for (int n = 0; n <= N - 1; n++) {
     bool flag = true;
-    for (int m = 0; m <= Q_Ftmp_N[N]; m++)
+    for (int m = 0; m <= Q_Ftmp_N[N]; m++){
+      AssertFatal(m < N+1, "Buffer boundary overflow");
       if (Q_0_Nminus1[n] == Q_Ftmp_N[m]) {
         flag = false;
         break;
       }
+    }
     if (flag) {
       Q_Itmp_N[Q_Itmp_N[N] + 1] = Q_0_Nminus1[n];
       Q_Itmp_N[N]++;

openair1/PHY/CODING/viterbi.c

@@ -292,6 +292,7 @@ void phy_viterbi_dot11_sse2(char *y,unsigned char *decoded_bytes,unsigned short
   // Traceback
   if (traceback == 1) {
     prev_state0 = 0;
+    AssertFatal((offset+n-1) > 0, "Left shift is undefined if the left operand is negative\n"); 
     TB_ptr2 = (unsigned char *)&TB[(offset+n-1)<<2];
 
     for (position = offset+n-1 ; position>-1; position--) {

openair1/PHY/LTE_TRANSPORT/prach.c

@@ -171,6 +171,8 @@ void rx_prach0(PHY_VARS_eNB *eNB,
   AssertFatal(ru!=NULL,"ru is null\n");
   int8_t dBEn0=0;
   int16_t *prach[nb_rx];
+  memset(prach, 0, nb_rx * sizeof(int16_t));
+
   for (int aa=0; aa<nb_rx; aa++) {
     if (ru->if_south == LOCAL_RF || ru->function == NGFI_RAU_IF5) { // set the time-domain signal if we have to use it in this node
       // DJP - indexing below in subframe zero takes us off the beginning of the array???

openair1/PHY/LTE_TRANSPORT/pucch.c

@@ -756,9 +756,9 @@ uint32_t calc_pucch_1x_interference(PHY_VARS_eNB *eNB,
   LTE_DL_FRAME_PARMS *frame_parms = &eNB->frame_parms;
 
   uint32_t u,v,n,aa;
-  uint32_t z[12*14];
-  int16_t *zptr;
-  int16_t rxcomp[NB_ANTENNAS_RX][2*12*14];
+  uint32_t z[12*14] = {0};
+  int16_t *zptr = NULL;
+  int16_t rxcomp[NB_ANTENNAS_RX][2*12*14] = {0};
   uint8_t ns,N_UL_symb,nsymb,n_cs_base;
   uint16_t i,j,re_offset;
   uint8_t m,l;

openair1/PHY/LTE_UE_TRANSPORT/dci_tools_ue.c

@@ -5188,7 +5188,7 @@ double sinr_eff_cqi_calc(PHY_VARS_UE *ue, uint8_t eNB_id, uint8_t subframe)
 
   sinr_eff_qam64 = (p_qam64[0]*pow(I_qam64_avg,7) + p_qam64[1]*pow(I_qam64_avg,6) + p_qam64[2]*pow(I_qam64_avg,5) + p_qam64[3]*pow(I_qam64_avg,4) + p_qam64[4]*pow(I_qam64_avg,
                     3) + p_qam64[5]*pow(I_qam64_avg,2) + p_qam64[6]*I_qam64_avg + p_qam64[7]);
-  sinr_eff = cmax3(sinr_eff_qpsk,sinr_eff_qam16,sinr_eff_qam64);
+  sinr_eff = cmax3(sinr_eff_qpsk, sinr_eff_qam16,sinr_eff_qam64);
 
   //printf("SINR_Eff = %e\n",sinr_eff);
 

openair1/PHY/NR_ESTIMATION/nr_ul_channel_estimation.c

@@ -634,10 +634,21 @@ int nr_srs_channel_estimation(const PHY_VARS_gNB *gNB,
 
   c16_t srs_ls_estimated_channel[frame_parms->ofdm_symbol_size*(1<<srs_pdu->num_symbols)];
   uint32_t noise_power_per_rb[srs_pdu->bwp_size];
-  int16_t ch_real[frame_parms->nb_antennas_rx*N_ap*M_sc_b_SRS];
-  int16_t ch_imag[frame_parms->nb_antennas_rx*N_ap*M_sc_b_SRS];
-  int16_t noise_real[frame_parms->nb_antennas_rx*N_ap*M_sc_b_SRS];
-  int16_t noise_imag[frame_parms->nb_antennas_rx*N_ap*M_sc_b_SRS];
+
+  const uint32_t arr_len = frame_parms->nb_antennas_rx * N_ap * M_sc_b_SRS;
+
+  int16_t ch_real[arr_len];
+  memset(ch_real, 0, arr_len * sizeof(int16_t));
+  
+  int16_t ch_imag[arr_len];
+  memset(ch_imag, 0, arr_len * sizeof(int16_t));
+ 
+  int16_t noise_real[arr_len];
+  memset(noise_real, 0, arr_len * sizeof(int16_t));
+ 
+  int16_t noise_imag[arr_len];
+  memset(noise_imag, 0, arr_len * sizeof(int16_t));
+
   int16_t ls_estimated[2];
 
   uint8_t mem_offset = ((16 - ((long)&srs_estimated_channel_freq[0][0][subcarrier_offset + nr_srs_info->k_0_p[0][0]])) & 0xF) >> 2; // >> 2 <=> /sizeof(int32_t)
@@ -836,8 +847,7 @@ int nr_srs_channel_estimation(const PHY_VARS_gNB *gNB,
   } // for (int ant = 0; ant < frame_parms->nb_antennas_rx; ant++)
 
   // Compute signal power
-  uint32_t signal_power = calc_power(ch_real,frame_parms->nb_antennas_rx*N_ap*M_sc_b_SRS)
-                          + calc_power(ch_imag,frame_parms->nb_antennas_rx*N_ap*M_sc_b_SRS);
+  uint32_t signal_power = calc_power(ch_real, arr_len) + calc_power(ch_imag, arr_len);
 
 #ifdef SRS_DEBUG
   LOG_I(NR_PHY,"signal_power = %u\n", signal_power);
@@ -890,8 +900,7 @@ int nr_srs_channel_estimation(const PHY_VARS_gNB *gNB,
 
   } // for (int rb = 0; rb < m_SRS_b; rb++)
 
-  uint32_t noise_power = max(calc_power(noise_real,frame_parms->nb_antennas_rx*N_ap*M_sc_b_SRS)
-                             + calc_power(noise_imag,frame_parms->nb_antennas_rx*N_ap*M_sc_b_SRS), 1);
+  const uint32_t noise_power = max(calc_power(noise_real, arr_len) + calc_power(noise_imag, arr_len), 1);
 
   *snr = dB_fixed((int32_t)((signal_power<<factor_bits)/(noise_power))) - factor_dB;
 

openair1/PHY/NR_TRANSPORT/nr_ulsch_demodulation.c

@@ -1178,7 +1178,8 @@ static uint8_t nr_ulsch_mmse_2layers(NR_DL_FRAME_PARMS *frame_parms,
 
       int sum_det = 0;
       for (int k = 0; k < 4; k++) {
-        sum_det += ((((int *)&determ_fin_128[0])[k]) >> 2);
+        AssertFatal(((int *)&determ_fin_128[0])[k] > 0 ,"Right shifting negative values is UB" );
+        sum_det += ((((uint32_t *)&determ_fin_128[0])[k]) >> 2);
       }
 
       int b = log2_approx(sum_det) - 8;

openair1/PHY/NR_TRANSPORT/pucch_rx.c

@@ -225,6 +225,8 @@ void nr_decode_pucch0(PHY_VARS_gNB *gNB,
   x_im[1] = table_5_2_2_2_2_Im[u[1]];
 
   c64_t xr[frame_parms->nb_antennas_rx][pucch_pdu->nr_of_symbols][12]  __attribute__((aligned(32)));
+  memset(xr, 0, frame_parms->nb_antennas_rx * pucch_pdu->nr_of_symbols * 12);
+
   int64_t xrtmag=0,xrtmag_next=0;
   uint8_t maxpos=0;
   uint8_t index=0;

openair1/PHY/NR_UE_ESTIMATION/nr_adjust_synch_ue.c

@@ -74,9 +74,10 @@ void nr_adjust_synch_ue(NR_DL_FRAME_PARMS *frame_parms,
   }
 
   // filter position to reduce jitter
-  if (clear == 1)
+  if (clear == 1){
+    AssertFatal(max_pos > -1, "The result of the left shift is undefined if the left operand is negative");
     ue->max_pos_fil = max_pos << 15;
-  else
+  } else
     ue->max_pos_fil = ((ue->max_pos_fil * coef) >> 15) + (max_pos * ncoef);
 
   // do not filter to have proactive timing adjustment

openair1/PHY/NR_UE_ESTIMATION/nr_dl_channel_estimation.c

@@ -129,6 +129,8 @@ int nr_prs_channel_estimation(uint8_t gNB_id,
     printf("[gNB %d][rsc %d] PRS config l %d k_prime %d:\nprs_cfg->SymbolStart %d\nprs_cfg->NumPRSSymbols %d\nprs_cfg->NumRB %d\nprs_cfg->CombSize %d\n", gNB_id, rsc_id, l, k_prime, prs_cfg->SymbolStart, prs_cfg->NumPRSSymbols, prs_cfg->NumRB, prs_cfg->CombSize);
 #endif
     // Pilots generation and modulation
+
+    AssertFatal(num_pilots > 0, "num_pilots needs to be gt 0 or mod_prs[0] UB");
     for (int m = 0; m < num_pilots; m++) 
     {
       idx = (((nr_gold_prs[l][(m<<1)>>5])>>((m<<1)&0x1f))&3);

openair1/PHY/NR_UE_TRANSPORT/cic_filter_nr.c

@@ -510,6 +510,8 @@ void cic_decimator(int16_t *input_buffer, int16_t *output_buffer, int length, in
 
 void fir_decimator(int16_t *input_buffer, int16_t *output_buffer, int length, int rate_change, int scaling_factor)
 {
+  AssertFatal(length > 0, "Precondition not met");
+
   int32_t *buffer_one;
   int32_t *buffer_two;
   int32_t *input;

openair1/PHY/NR_UE_TRANSPORT/csi_rx.c

@@ -409,6 +409,7 @@ int nr_csi_rs_channel_estimation(const PHY_VARS_NR_UE *ue,
     }
 
     /// Power noise estimation
+    AssertFatal(csirs_config_pdu->nr_of_rbs > 0, " nr_of_rbs needs to be greater than 0\n");
     uint16_t noise_real[frame_parms->nb_antennas_rx][N_ports][csirs_config_pdu->nr_of_rbs];
     uint16_t noise_imag[frame_parms->nb_antennas_rx][N_ports][csirs_config_pdu->nr_of_rbs];
     for (int rb = csirs_config_pdu->start_rb; rb < (csirs_config_pdu->start_rb+csirs_config_pdu->nr_of_rbs); rb++) {

openair1/PHY/NR_UE_TRANSPORT/nr_dlsch_demodulation.c

@@ -275,7 +275,6 @@ int nr_rx_pdsch(PHY_VARS_NR_UE *ue,
   const int frame = proc->frame_rx;
   const int nr_slot_rx = proc->nr_slot_rx;
   const int gNB_id = proc->gNB_id;
-
   uint8_t slot = 0;
 
   int32_t codeword_TB0 = -1;
@@ -699,7 +698,7 @@ void nr_dlsch_deinterleaving(uint8_t symbol,
   N_bundle = nb_rb_pdsch/L;
   C=N_bundle/R;
 
-  uint32_t *bundle_deint = malloc(N_bundle*sizeof(uint32_t));
+  uint32_t *bundle_deint = calloc(N_bundle, sizeof(uint32_t));
 
   printf("N_bundle %u L %d nb_rb_pdsch %d\n",N_bundle, L,nb_rb_pdsch);
 

openair1/PHY/NR_UE_TRANSPORT/pucch_nr.c

@@ -895,6 +895,8 @@ void nr_generate_pucch3_4(const PHY_VARS_NR_UE *ue,
    * n_id = N_ID_cell       if higher layer parameter not configured
    */
   uint8_t btilde[M_bit];
+  memset(btilde, 0, sizeof(btilde));
+  
   // rnti is given by the C-RNTI
   uint16_t rnti=pucch_pdu->rnti, n_id=0;
 #ifdef DEBUG_NR_PUCCH_TX
@@ -912,6 +914,8 @@ void nr_generate_pucch3_4(const PHY_VARS_NR_UE *ue,
    */
   // complex-valued symbol d(0)
   c16_t d[M_bit];
+  memset(d, 0, sizeof(d));
+
   uint16_t m_symbol = (M_bit%2==0) ? M_bit/2 : floor(M_bit/2)+1;
   const int16_t baseVal = (amp * ONE_OVER_SQRT2) >> 15;
 
@@ -962,6 +966,7 @@ void nr_generate_pucch3_4(const PHY_VARS_NR_UE *ue,
   // uint8_t nrofSymbols;
   // complex-valued symbol d(0)
   c16_t y_n[4 * M_bit]; // 4 is the maximum number n_SF_PUCCH_s, so is the maximunm size of y_n
+  memset(y_n, 0, sizeof(y_n));
   // Re part orthogonal sequences w_n(k) for PUCCH format 4 when N_SF_PUCCH4 = 2 (Table 6.3.2.6.3-1)
   // k={0,..11} n={0,1,2,3}
   // parameter PUCCH-F4-preDFT-OCC-index set of {0,1,2,3} -> n
@@ -1051,6 +1056,8 @@ void nr_generate_pucch3_4(const PHY_VARS_NR_UE *ue,
    * Implementing Transform pre-coding subclause 6.3.2.6.4
    */
   c16_t z[4 * M_bit]; // 4 is the maximum number n_SF_PUCCH_s
+  memset(z, 0 , sizeof(z));
+
 #define M_PI 3.14159265358979323846 // pi
   const int64_t base = round(32767 / sqrt(12 * nrofPRB));
   for (int l=0; l<floor((n_SF_PUCCH_s*m_symbol)/(12*nrofPRB)); l++) {

openair1/PHY/NR_UE_TRANSPORT/sss_nr.c

@@ -267,6 +267,7 @@ static int do_pss_sss_extract_nr(
     c16_t rxdataF[][ue->frame_parms.samples_per_slot_wCP]) // add flag to indicate extracting only PSS, only SSS, or both
 {
   NR_DL_FRAME_PARMS *frame_parms = &ue->frame_parms;
+  AssertFatal(frame_parms->nb_antennas_rx > 0, "UB as sss_ext is not set to any value\n");
 
   for (int aarx = 0; aarx < frame_parms->nb_antennas_rx; aarx++) {
     int pss_symbol = 0;
@@ -370,7 +371,9 @@ bool rx_sss_nr(PHY_VARS_NR_UE *ue,
 {
   uint8_t i;
   c16_t pss_ext[NB_ANTENNAS_RX][LENGTH_PSS_NR];
+  memset(pss_ext, 0, NB_ANTENNAS_RX * LENGTH_SSS_NR * sizeof(c16_t));
   c16_t sss_ext[NB_ANTENNAS_RX][LENGTH_SSS_NR];
+  memset(sss_ext, 0, NB_ANTENNAS_RX * LENGTH_SSS_NR * sizeof(c16_t));
   uint8_t Nid2 = GET_NID2(ue->common_vars.nid2);
   uint16_t Nid1;
   uint8_t phase;

openair1/PHY/defs_nr_UE.h

@@ -86,9 +86,9 @@
 #define openair_sched_exit() exit(-1)
 
 #define bzero(s,n) (memset((s),0,(n)))
-#define cmax(a,b)  ((a>b) ? (a) : (b))
-#define cmin(a,b)  ((a<b) ? (a) : (b))
-#define cmax3(a,b,c) ((cmax(a,b)>c) ? (cmax(a,b)) : (c))
+//#define cmax(a,b)  ((a>b) ? (a) : (b))
+//#define cmin(a,b)  ((a<b) ? (a) : (b))
+//#define cmax3(a,b,c) ((cmax(a,b)>c) ? (cmax(a,b)) : (c))
 /// suppress compiler warning for unused arguments
 #define UNUSED(x) (void)x;
 

openair1/SIMULATION/RF/dac.c

@@ -94,12 +94,10 @@ double dac_fixed_gain(double *s_re[2],
 
   int i;
   int aa;
-  double amp1_local,*amp1p;
+  double amp1_local = 0.0;
+  double *amp1p = (amp1 == NULL) ? &amp1_local : amp1;
   double amp = pow(10.0,.05*txpwr_dBm)/sqrt(nb_tx_antennas); //this is amp per tx antenna
 
-  if (amp1==NULL) amp1p = &amp1_local;
-  else            amp1p = amp1;
-
   if (do_amp_compute==1) {
     *amp1p = 0;
     for (aa=0; aa<nb_tx_antennas; aa++) {
@@ -124,6 +122,7 @@ double dac_fixed_gain(double *s_re[2],
 
 #endif
 
+  AssertFatal(amp1p != NULL && *amp1p != 0.0, "Precondition to avoid UB\n");
   for (i=0; i<length; i++) {
     for (aa=0; aa<nb_tx_antennas; aa++) {
       s_re[aa][i] = amp*((double)(((short *)input[aa]))[((i+input_offset)<<1)])/(*amp1p); 

openair2/ENB_APP/enb_app.c

@@ -195,7 +195,7 @@ void *eNB_app_task(void *args_p) {
   uint32_t                        enb_id_end = enb_id_start + enb_nb;
   uint32_t                        register_enb_pending=0;
   uint32_t                        registered_enb=0;
-  long                            enb_register_retry_timer_id;
+  long                            enb_register_retry_timer_id = 0;
   uint32_t                        x2_register_enb_pending = 0;
   uint32_t                        x2_registered_enb = 0;
   long                            x2_enb_register_retry_timer_id;

openair2/LAYER2/MAC/eNB_scheduler_fairRR.c

@@ -1648,7 +1648,6 @@ schedule_ue_spec_fairRR(module_id_t module_idP,
             header_len_dcch += 2;
             UE_info->eNB_UE_stats[CC_id][UE_id].num_pdu_tx[DCCH1] += 1;
             UE_info->eNB_UE_stats[CC_id][UE_id].num_bytes_tx[DCCH1] += sdu_lengths[num_sdus];
-            num_sdus++;
 #ifdef DEBUG_eNB_SCHEDULER
             LOG_T(MAC,
                   "[eNB %d][DCCH1] CC_id %d Got %d bytes :",
@@ -1660,6 +1659,7 @@ schedule_ue_spec_fairRR(module_id_t module_idP,
 
             LOG_T(MAC, "\n");
 #endif
+            num_sdus++;
           }
         }
 

openair2/LAYER2/MAC/eNB_scheduler_primitives.c

@@ -4539,7 +4539,8 @@ extract_pucch_csi(module_id_t mod_idP,
   AssertFatal(cqi_ReportPeriodic->present != LTE_CQI_ReportPeriodic_PR_NOTHING, "cqi_ReportPeriodic->present == LTE_CQI_ReportPeriodic_PR_NOTHING!\n");
   AssertFatal(cqi_ReportPeriodic->choice.setup.cqi_FormatIndicatorPeriodic.present != LTE_CQI_ReportPeriodic__setup__cqi_FormatIndicatorPeriodic_PR_NOTHING,
               "cqi_ReportPeriodic->cqi_FormatIndicatorPeriodic.choice.setup.present == LTE_CQI_ReportPeriodic__setup__cqi_FormatIndicatorPeriodic_PR_NOTHING!\n");
-  uint16_t Npd, N_OFFSET_CQI;
+  uint16_t Npd = 0;
+  uint16_t N_OFFSET_CQI = 0;
   int H, K, bandwidth_part, L, Lmask;
   int ri = sched_ctl->periodic_ri_received[CC_idP];
   get_csi_params(cc,

openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_srs.c

@@ -186,6 +186,7 @@ void nr_srs_ri_computation(const nfapi_nr_srs_normalized_channel_iq_matrix_t *nr
 
   if ((row == 2 && col == 2) || (row == 4 && col == 2)) {
     int array_lim = num_prgs >> 2;
+    AssertFatal(array_lim > 0 , "Needed to avoid UB\n");
     int antenna_rank[array_lim];
     int count = 0;
 

openair2/MCE_APP/mce_app.c

@@ -315,7 +315,7 @@ void *MCE_app_task(void *args_p) {
   uint32_t                        register_mce_pending=0;
   uint32_t                        registered_mce=0;
   //long                            mce_register_retry_timer_id;
-  long 				  mce_scheduling_info_timer_id;
+  long 				  mce_scheduling_info_timer_id = 0;
   //uint32_t                        m3_register_mce_pending = 0;
  // uint32_t                        x2_registered_mce = 0;
  // long                            x2_mce_register_retry_timer_id;

openair3/NAS/UE/EMM/IdleMode.c

@@ -679,7 +679,7 @@ int emm_proc_plmn_selection_end(nas_user_t *user, int found, tac_t tac, ci_t ci,
 {
   LOG_FUNC_IN;
 
-  emm_sap_t emm_sap;
+  emm_sap_t emm_sap = {0};
   int rc = RETURNerror;
   emm_data_t *emm_data = user->emm_data;
   emm_plmn_list_t *emm_plmn_list = user->emm_plmn_list;