NR UE Seg Fault rec_1560

In 2025.w45/openair2/RRC/NR_UE/rrc_UE.c, at line 826.

    NR_RRCReconfiguration_v1560_IEs_t *rec_1560 = rec_1540->nonCriticalExtension;
    if (rec_1560->sk_Counter) {
      // TODO perform AS security key update procedure as specified in 5.3.5.7
      LOG_E(NR_RRC, "RRCReconfiguration includes sk-Counter but this is not implemented yet\n");
    }

However, the ASN.1 definition for rec_1560 is an OPTIONAL field.

RRCReconfiguration-v1540-IEs ::=        SEQUENCE {
    otherConfig-v1540                       OtherConfig-v1540                                                      OPTIONAL, -- Need M
    nonCriticalExtension                    RRCReconfiguration-v1560-IEs                                           OPTIONAL
}

So there is a chance rec_1560 is NULL. Thus accessing the sk_Counter field would cause a Seg Fault.

For example, 04 08 0c 00 Or

<DL-DCCH-Message>
  <message>
    <c1>
      <rrcReconfiguration>
        <rrc-TransactionIdentifier>2</rrc-TransactionIdentifier>
        <criticalExtensions>
          <rrcReconfiguration>
            <nonCriticalExtension>
              <nonCriticalExtension>
                <otherConfig-v1540/>
              </nonCriticalExtension>
            </nonCriticalExtension>
          </rrcReconfiguration>
        </criticalExtensions>
      </rrcReconfiguration>
    </c1>
  </message>
</DL-DCCH-Message>
Edited Nov 08, 2025 by XIAOTIAN ZHOU
Assignee Loading
Time tracking Loading