• Gabriele Gemmi's avatar
    nfapi: fix integer overflows in SRS report handling for large arrays · 5fb8973d
    Gabriele Gemmi authored
    With 64 gNB antenna elements the SRS channel IQ matrix exceeds the
    ranges the SRS report code path was written for (272 PRGs * 2 UE ports
    * 64 elements * 4 B = 136 KiB per report):
    
    - unpack_nr_srs_report_tlv_value(): last_idx was int16_t, which
      overflows at report lengths >= 128 KiB, so the copy loop never ran
      and the report was silently dropped. Widen to int32_t and reject
      reports larger than the value buffer instead of overrunning it.
    - pack/unpack_nr_srs_normalized_channel_iq_matrix():
      channel_matrix_size was uint16_t and wraps at 64 KiB, truncating the
      matrix. Widen to uint32_t and bound it by sizeof(channel_matrix).
    - handle_nr_srs_measurements(): the SRS_IND_DEBUG print indexed the
      matrix with a uint16_t, which wraps for Nu*Ng*Np > 65535.
    
    Assisted-by: Claude Code:claude-fable-5
    Signed-off-by: default avatarGabriele Gemmi <g.gemmi@northeastern.edu>
    5fb8973d
nr_fapi_p7.c 108 KB