diff --git a/openair2/COMMON/rrc_messages_def.h b/openair2/COMMON/rrc_messages_def.h
index 8312db19bf913e1f22593f6dc5abb43ca9e9766e..f2efaa9cb2f348d16c2416a8a708e099f4bf6009 100644
--- a/openair2/COMMON/rrc_messages_def.h
+++ b/openair2/COMMON/rrc_messages_def.h
@@ -14,8 +14,12 @@ MESSAGE_DEF(RRC_MAC_OUT_OF_SYNC_IND,    MESSAGE_PRIORITY_MED_PLUS, RrcMacOutOfSy
 
 MESSAGE_DEF(RRC_MAC_BCCH_DATA_REQ,      MESSAGE_PRIORITY_MED_PLUS, RrcMacBcchDataReq,           rrc_mac_bcch_data_req)
 MESSAGE_DEF(RRC_MAC_BCCH_DATA_IND,      MESSAGE_PRIORITY_MED_PLUS, RrcMacBcchDataInd,           rrc_mac_bcch_data_ind)
+
+MESSAGE_DEF(RRC_MAC_CCCH_DATA_REQ,      MESSAGE_PRIORITY_MED_PLUS, RrcMacCcchDataReq,           rrc_mac_ccch_data_req)
+MESSAGE_DEF(RRC_MAC_CCCH_DATA_CNF,      MESSAGE_PRIORITY_MED_PLUS, RrcMacCcchDataCnf,           rrc_mac_ccch_data_cnf)
 MESSAGE_DEF(RRC_MAC_CCCH_DATA_IND,      MESSAGE_PRIORITY_MED_PLUS, RrcMacCcchDataInd,           rrc_mac_ccch_data_ind)
-MESSAGE_DEF(RRC_MAC_CCCH_SUCCESS_IND,   MESSAGE_PRIORITY_MED_PLUS, RrcMacCcchSuccessInd,        rrc_mac_ccch_success_ind)
+
+MESSAGE_DEF(RRC_MAC_MCCH_DATA_REQ,      MESSAGE_PRIORITY_MED_PLUS, RrcMacMcchDataReq,           rrc_mac_mcch_data_req)
 MESSAGE_DEF(RRC_MAC_MCCH_DATA_IND,      MESSAGE_PRIORITY_MED_PLUS, RrcMacMcchDataInd,           rrc_mac_mcch_data_ind)
 
 //-------------------------------------------------------------------------------------------//
diff --git a/openair2/COMMON/rrc_messages_types.h b/openair2/COMMON/rrc_messages_types.h
index 9114bca1df0f8d201a3832029fe6c85b47884bb9..362009a3001ad00e8389ac7a157fe4da81630cf9 100644
--- a/openair2/COMMON/rrc_messages_types.h
+++ b/openair2/COMMON/rrc_messages_types.h
@@ -18,13 +18,22 @@
 
 #define RRC_MAC_BCCH_DATA_REQ(mSGpTR)           (mSGpTR)->msg.rrc_mac_bcch_data_req
 #define RRC_MAC_BCCH_DATA_IND(mSGpTR)           (mSGpTR)->msg.rrc_mac_bcch_data_ind
+
+#define RRC_MAC_CCCH_DATA_REQ(mSGpTR)           (mSGpTR)->msg.rrc_mac_ccch_data_req
+#define RRC_MAC_CCCH_DATA_CNF(mSGpTR)           (mSGpTR)->msg.rrc_mac_ccch_data_cnf
 #define RRC_MAC_CCCH_DATA_IND(mSGpTR)           (mSGpTR)->msg.rrc_mac_ccch_data_ind
-#define RRC_MAC_CCCH_SUCCESS_IND(mSGpTR)        (mSGpTR)->msg.rrc_mac_ccch_success_ind
+
+#define RRC_MAC_MCCH_DATA_REQ(mSGpTR)           (mSGpTR)->msg.rrc_mac_mcch_data_req
 #define RRC_MAC_MCCH_DATA_IND(mSGpTR)           (mSGpTR)->msg.rrc_mac_mcch_data_ind
 
 #define RRC_DCCH_DATA_REQ(mSGpTR)               (mSGpTR)->msg.rrc_dcch_data_req
 #define RRC_DCCH_DATA_IND(mSGpTR)               (mSGpTR)->msg.rrc_dcch_data_ind
 
+// Some constants from "LAYER2/MAC/defs.h"
+#define BCCH_SDU_SIZE                           (128)
+#define CCCH_SDU_SIZE                           (128)
+#define MCCH_SDU_SIZE                           (128)
+
 typedef UE_EUTRA_Capability_t RrcUeEutraCapability;
 
 //-------------------------------------------------------------------------------------------//
@@ -40,27 +49,47 @@ typedef RrcMacInSyncInd RrcMacOutOfSyncInd;
 typedef struct {
   uint32_t frame;
   uint32_t sdu_size;
-  uint8_t *sdu_p;
+  uint8_t sdu[BCCH_SDU_SIZE];
   uint8_t enb_index;
 } RrcMacBcchDataReq;
 
 typedef struct {
   uint32_t frame;
   uint32_t sdu_size;
-  uint8_t *sdu_p;
+  uint8_t sdu[BCCH_SDU_SIZE];
   uint8_t enb_index;
 } RrcMacBcchDataInd;
 
-typedef RrcMacBcchDataInd RrcMacCcchDataInd;
+typedef struct {
+  uint32_t frame;
+  uint32_t sdu_size;
+  uint8_t sdu[CCCH_SDU_SIZE];
+  uint8_t enb_index;
+} RrcMacCcchDataReq;
+
+typedef struct {
+  uint8_t enb_index;
+} RrcMacCcchDataCnf;
+
+typedef struct {
+    uint32_t frame;
+    uint32_t sdu_size;
+    uint8_t sdu[CCCH_SDU_SIZE];
+    uint8_t enb_index;
+} RrcMacCcchDataInd;
 
 typedef struct {
+  uint32_t frame;
+  uint32_t sdu_size;
+  uint8_t sdu[MCCH_SDU_SIZE];
   uint8_t enb_index;
-} RrcMacCcchSuccessInd;
+  uint8_t mbsfn_sync_area;
+} RrcMacMcchDataReq;
 
 typedef struct {
   uint32_t frame;
   uint32_t sdu_size;
-  uint8_t *sdu_p;
+  uint8_t sdu[MCCH_SDU_SIZE];
   uint8_t enb_index;
   uint8_t mbsfn_sync_area;
 } RrcMacMcchDataInd;
diff --git a/openair2/LAYER2/MAC/eNB_scheduler.c b/openair2/LAYER2/MAC/eNB_scheduler.c
index 45b773960a5c3672018346a3165efc6a68cca8de..a8cd4ac648ddffc395bb74789463bb0e0634b033 100644
--- a/openair2/LAYER2/MAC/eNB_scheduler.c
+++ b/openair2/LAYER2/MAC/eNB_scheduler.c
@@ -4224,12 +4224,29 @@ void eNB_dlsch_ulsch_scheduler(u8 Mod_id,u8 cooperation_flag, u32 frame, u8 subf
                 msg_name, ITTI_MSG_ORIGIN_NAME(msg_p), instance,
                 RRC_MAC_BCCH_DATA_REQ (msg_p).frame, RRC_MAC_BCCH_DATA_REQ (msg_p).enb_index);
 
-          // Message buffer has been processed, free it now.
-          free (RRC_MAC_BCCH_DATA_REQ (msg_p).sdu_p);
+          // TODO process BCCH data req.
           break;
 
+        case RRC_MAC_CCCH_DATA_REQ:
+          LOG_D(MAC, "Received %s from %s: instance %d, frame %d, eNB_index %d\n",
+                msg_name, ITTI_MSG_ORIGIN_NAME(msg_p), instance,
+                RRC_MAC_CCCH_DATA_REQ (msg_p).frame, RRC_MAC_CCCH_DATA_REQ (msg_p).enb_index);
+
+          // TODO process CCCH data req.
+          break;
+
+#ifdef Rel10
+        case RRC_MAC_MCCH_DATA_REQ:
+          LOG_D(MAC, "Received %s from %s: instance %d, frame %d, eNB_index %d, mbsfn_sync_area %d\n",
+                msg_name, ITTI_MSG_ORIGIN_NAME(msg_p), instance,
+                RRC_MAC_MCCH_DATA_REQ (msg_p).frame, RRC_MAC_MCCH_DATA_REQ (msg_p).enb_index, RRC_MAC_MCCH_DATA_REQ (msg_p).mbsfn_sync_area);
+
+          // TODO process MCCH data req.
+          break;
+#endif
+
         default:
-          LOG_E(MAC, "Received unexpected message %s\n", msg_name));
+          LOG_E(MAC, "Received unexpected message %s\n", msg_name);
           break;
       }
 
diff --git a/openair2/LAYER2/MAC/ue_procedures.c b/openair2/LAYER2/MAC/ue_procedures.c
index a59d486cab7f6f1147de006202f86200adafe544..b46b9faf54e4081cfab8212a0b6d1aede70e7af6 100644
--- a/openair2/LAYER2/MAC/ue_procedures.c
+++ b/openair2/LAYER2/MAC/ue_procedures.c
@@ -1276,7 +1276,9 @@ UE_L2_STATE_t ue_scheduler(u8 Mod_id,u32 frame, u8 subframe, lte_subframe_t dire
   // mac_rlc_status_resp_t rlc_status[MAX_NUM_LCGID]; // 4
   // s8 lcg_id;
   struct RACH_ConfigCommon *rach_ConfigCommon = (struct RACH_ConfigCommon *)NULL;
+#ifdef EXMIMO
   int ret;  
+#endif
 #if defined(ENABLE_ITTI)
   MessageDef *msg_p;
   const char *msg_name;
@@ -1295,6 +1297,14 @@ UE_L2_STATE_t ue_scheduler(u8 Mod_id,u32 frame, u8 subframe, lte_subframe_t dire
       instance = ITTI_MSG_INSTANCE (msg_p);
 
       switch (msg_p->header.messageId) {
+        case RRC_MAC_CCCH_DATA_REQ:
+          LOG_D(MAC, "Received %s from %s: instance %d, frame %d, eNB_index %d\n",
+                msg_name, ITTI_MSG_ORIGIN_NAME(msg_p), instance,
+                RRC_MAC_CCCH_DATA_REQ (msg_p).frame, RRC_MAC_CCCH_DATA_REQ (msg_p).enb_index);
+
+          // TODO process CCCH data req.
+          break;
+
 
         default:
           LOG_E(MAC, "Received unexpected message %s\n", msg_name);
diff --git a/openair2/RRC/LITE/L2_interface.c b/openair2/RRC/LITE/L2_interface.c
index ce0da8a544646cb24d32977e2500c12546149315..af1486fde134c9652d75f3c1d4b3dcfc94b41623 100644
--- a/openair2/RRC/LITE/L2_interface.c
+++ b/openair2/RRC/LITE/L2_interface.c
@@ -90,17 +90,20 @@ s8 mac_rrc_lite_data_req(u8 Mod_id, u32 frame, u16 Srb_id, u8 Nb_tb, u8 *Buffer,
 #if defined(ENABLE_ITTI)
       {
         MessageDef *message_p;
-        // Uses a new buffer to avoid issue with MAC buffer content that could be changed by MAC (asynchronous message handling).
-        u8 *message_buffer;
+        int sib1_size = eNB_rrc_inst[Mod_id].sizeof_SIB1;
+        int sdu_size = sizeof(RRC_MAC_BCCH_DATA_REQ (message_p).sdu);
 
-        message_buffer = malloc (eNB_rrc_inst[Mod_id].sizeof_SIB1);
-        memcpy (message_buffer, eNB_rrc_inst[Mod_id].SIB1, eNB_rrc_inst[Mod_id].sizeof_SIB1);
+        if (sib1_size > sdu_size)
+        {
+          LOG_E(RRC, "SIB1 SDU larger than BCCH SDU buffer size (%d, %d)", sib1_size, sdu_size);
+          sib1_size = sdu_size;
+        }
 
         message_p = itti_alloc_new_message (TASK_RRC_ENB, RRC_MAC_BCCH_DATA_REQ);
-        RRC_MAC_BCCH_DATA_IND (message_p).frame = frame;
-        RRC_MAC_BCCH_DATA_IND (message_p).sdu_size = eNB_rrc_inst[Mod_id].sizeof_SIB1;
-        RRC_MAC_BCCH_DATA_IND (message_p).sdu_p = message_buffer;
-        RRC_MAC_BCCH_DATA_IND (message_p).enb_index = eNB_index;
+        RRC_MAC_BCCH_DATA_REQ (message_p).frame = frame;
+        RRC_MAC_BCCH_DATA_REQ (message_p).sdu_size = sib1_size;
+        memcpy (RRC_MAC_BCCH_DATA_REQ (message_p).sdu, eNB_rrc_inst[Mod_id].SIB1, sib1_size);
+        RRC_MAC_BCCH_DATA_REQ (message_p).enb_index = eNB_index;
 
         itti_send_msg_to_task (TASK_MAC_ENB, Mod_id, message_p);
       }
@@ -121,17 +124,20 @@ s8 mac_rrc_lite_data_req(u8 Mod_id, u32 frame, u16 Srb_id, u8 Nb_tb, u8 *Buffer,
 #if defined(ENABLE_ITTI)
       {
         MessageDef *message_p;
-        // Uses a new buffer to avoid issue with MAC buffer content that could be changed by MAC (asynchronous message handling).
-        u8 *message_buffer;
+        int sib23_size = eNB_rrc_inst[Mod_id].sizeof_SIB23;
+        int sdu_size = sizeof(RRC_MAC_BCCH_DATA_REQ (message_p).sdu);
 
-        message_buffer = malloc (eNB_rrc_inst[Mod_id].sizeof_SIB23);
-        memcpy (message_buffer, eNB_rrc_inst[Mod_id].SIB23, eNB_rrc_inst[Mod_id].sizeof_SIB23);
+        if (sib23_size > sdu_size)
+        {
+          LOG_E(RRC, "SIB23 SDU larger than BCCH SDU buffer size (%d, %d)", sib23_size, sdu_size);
+          sib23_size = sdu_size;
+        }
 
         message_p = itti_alloc_new_message (TASK_RRC_ENB, RRC_MAC_BCCH_DATA_REQ);
-        RRC_MAC_BCCH_DATA_IND (message_p).frame = frame;
-        RRC_MAC_BCCH_DATA_IND (message_p).sdu_size = eNB_rrc_inst[Mod_id].sizeof_SIB23;
-        RRC_MAC_BCCH_DATA_IND (message_p).sdu_p = message_buffer;
-        RRC_MAC_BCCH_DATA_IND (message_p).enb_index = eNB_index;
+        RRC_MAC_BCCH_DATA_REQ (message_p).frame = frame;
+        RRC_MAC_BCCH_DATA_REQ (message_p).sdu_size = sib23_size;
+        memcpy (RRC_MAC_BCCH_DATA_REQ (message_p).sdu, eNB_rrc_inst[Mod_id].SIB23, sib23_size);
+        RRC_MAC_BCCH_DATA_REQ (message_p).enb_index = eNB_index;
 
         itti_send_msg_to_task (TASK_MAC_ENB, Mod_id, message_p);
       }
@@ -162,7 +168,29 @@ s8 mac_rrc_lite_data_req(u8 Mod_id, u32 frame, u16 Srb_id, u8 Nb_tb, u8 *Buffer,
       // check if data is there for MAC
       if(Srb_info->Tx_buffer.payload_size>0){//Fill buffer
 	LOG_D(RRC,"[eNB %d] CCCH (%p) has %d bytes (dest: %p, src %p)\n",Mod_id,Srb_info,Srb_info->Tx_buffer.payload_size,Buffer,Srb_info->Tx_buffer.Payload);
-	memcpy(Buffer,Srb_info->Tx_buffer.Payload,Srb_info->Tx_buffer.payload_size);
+
+#if defined(ENABLE_ITTI)
+        {
+          MessageDef *message_p;
+          int ccch_size = Srb_info->Tx_buffer.payload_size;
+          int sdu_size = sizeof(RRC_MAC_CCCH_DATA_REQ (message_p).sdu);
+
+          if (ccch_size > sdu_size) {
+            LOG_E(RRC, "SDU larger than CCCH SDU buffer size (%d, %d)", ccch_size, sdu_size);
+            ccch_size = sdu_size;
+          }
+
+          message_p = itti_alloc_new_message (TASK_RRC_ENB, RRC_MAC_CCCH_DATA_REQ);
+          RRC_MAC_CCCH_DATA_REQ (message_p).frame = frame;
+          RRC_MAC_CCCH_DATA_REQ (message_p).sdu_size = ccch_size;
+          memcpy (RRC_MAC_CCCH_DATA_REQ (message_p).sdu, Srb_info->Tx_buffer.Payload, ccch_size);
+          RRC_MAC_CCCH_DATA_REQ (message_p).enb_index = eNB_index;
+
+          itti_send_msg_to_task (TASK_MAC_ENB, Mod_id, message_p);
+        }
+#endif
+
+        memcpy(Buffer,Srb_info->Tx_buffer.Payload,Srb_info->Tx_buffer.payload_size);
 	Sdu_size = Srb_info->Tx_buffer.payload_size;
 	Srb_info->Tx_buffer.payload_size=0;
       }
@@ -178,6 +206,30 @@ s8 mac_rrc_lite_data_req(u8 Mod_id, u32 frame, u16 Srb_id, u8 Nb_tb, u8 *Buffer,
 	LOG_E(RRC,"[eNB %d] MAC Request for MCCH MESSAGE and MCCH MESSAGE is not initialized\n",Mod_id);
 	mac_xface->macphy_exit("");
 	}*/
+
+
+#if defined(ENABLE_ITTI)
+      {
+        MessageDef *message_p;
+        int mcch_size = eNB_rrc_inst[Mod_id].sizeof_MCCH_MESSAGE[mbsfn_sync_area];
+        int sdu_size = sizeof(RRC_MAC_MCCH_DATA_REQ (message_p).sdu);
+
+        if (mcch_size > sdu_size) {
+          LOG_E(RRC, "SDU larger than MCCH SDU buffer size (%d, %d)", mcch_size, sdu_size);
+          mcch_size = sdu_size;
+        }
+
+        message_p = itti_alloc_new_message (TASK_RRC_ENB, RRC_MAC_MCCH_DATA_REQ);
+        RRC_MAC_MCCH_DATA_REQ (message_p).frame = frame;
+        RRC_MAC_MCCH_DATA_REQ (message_p).sdu_size = mcch_size;
+        memcpy (RRC_MAC_MCCH_DATA_REQ (message_p).sdu, eNB_rrc_inst[Mod_id].MCCH_MESSAGE[mbsfn_sync_area], mcch_size);
+        RRC_MAC_MCCH_DATA_REQ (message_p).enb_index = eNB_index;
+        RRC_MAC_MCCH_DATA_REQ (message_p).mbsfn_sync_area = mbsfn_sync_area;
+
+        itti_send_msg_to_task (TASK_MAC_ENB, Mod_id, message_p);
+      }
+#endif
+
       memcpy(&Buffer[0],
 	     eNB_rrc_inst[Mod_id].MCCH_MESSAGE[mbsfn_sync_area],
 	     eNB_rrc_inst[Mod_id].sizeof_MCCH_MESSAGE[mbsfn_sync_area]);
@@ -203,6 +255,28 @@ s8 mac_rrc_lite_data_req(u8 Mod_id, u32 frame, u16 Srb_id, u8 Nb_tb, u8 *Buffer,
     LOG_D(RRC,"[UE %d] Frame %d Buffer status %d,\n",Mod_id,frame, UE_rrc_inst[Mod_id].Srb0[eNB_index].Tx_buffer.payload_size);
 #endif
     if( (UE_rrc_inst[Mod_id].Srb0[eNB_index].Tx_buffer.payload_size > 0) ) {
+
+#if defined(ENABLE_ITTI)
+      {
+        MessageDef *message_p;
+        int ccch_size = UE_rrc_inst[Mod_id].Srb0[eNB_index].Tx_buffer.payload_size;
+        int sdu_size = sizeof(RRC_MAC_CCCH_DATA_REQ (message_p).sdu);
+
+        if (ccch_size > sdu_size) {
+          LOG_E(RRC, "SDU larger than CCCH SDU buffer size (%d, %d)", ccch_size, sdu_size);
+          ccch_size = sdu_size;
+        }
+
+        message_p = itti_alloc_new_message (TASK_RRC_UE, RRC_MAC_CCCH_DATA_REQ);
+        RRC_MAC_CCCH_DATA_REQ (message_p).frame = frame;
+        RRC_MAC_CCCH_DATA_REQ (message_p).sdu_size = ccch_size;
+        memcpy (RRC_MAC_CCCH_DATA_REQ (message_p).sdu, UE_rrc_inst[Mod_id].Srb0[eNB_index].Tx_buffer.Payload, ccch_size);
+        RRC_MAC_CCCH_DATA_REQ (message_p).enb_index = eNB_index;
+
+        itti_send_msg_to_task (TASK_MAC_UE, Mod_id, message_p);
+      }
+#endif
+
       memcpy(&Buffer[0],&UE_rrc_inst[Mod_id].Srb0[eNB_index].Tx_buffer.Payload[0],UE_rrc_inst[Mod_id].Srb0[eNB_index].Tx_buffer.payload_size);
       u8 Ret_size=UE_rrc_inst[Mod_id].Srb0[eNB_index].Tx_buffer.payload_size;
       //   UE_rrc_inst[Mod_id].Srb0[eNB_index].Tx_buffer.payload_size=0;
@@ -235,16 +309,18 @@ s8 mac_rrc_lite_data_ind(u8 Mod_id, u32 frame, u16 Srb_id, u8 *Sdu, u16 sdu_size
 #if defined(ENABLE_ITTI)
       {
         MessageDef *message_p;
-        // Uses a new buffer to avoid issue with MAC buffer content that could be changed by MAC (asynchronous message handling).
-        u8 *message_buffer;
+        int msg_sdu_size = sizeof(RRC_MAC_BCCH_DATA_IND (message_p).sdu);
 
-        message_buffer = malloc (sdu_size);
-        memcpy (message_buffer, Sdu, sdu_size);
+        if (sdu_size > msg_sdu_size)
+        {
+          LOG_E(RRC, "SDU larger than BCCH SDU buffer size (%d, %d)", sdu_size, msg_sdu_size);
+          sdu_size = msg_sdu_size;
+        }
 
         message_p = itti_alloc_new_message (TASK_MAC_UE, RRC_MAC_BCCH_DATA_IND);
         RRC_MAC_BCCH_DATA_IND (message_p).frame = frame;
         RRC_MAC_BCCH_DATA_IND (message_p).sdu_size = sdu_size;
-        RRC_MAC_BCCH_DATA_IND (message_p).sdu_p = message_buffer;
+        memcpy (RRC_MAC_BCCH_DATA_IND (message_p).sdu, Sdu, sdu_size);
         RRC_MAC_BCCH_DATA_IND (message_p).enb_index = eNB_index;
 
         itti_send_msg_to_task (TASK_RRC_UE, Mod_id, message_p);
@@ -301,16 +377,18 @@ s8 mac_rrc_lite_data_ind(u8 Mod_id, u32 frame, u16 Srb_id, u8 *Sdu, u16 sdu_size
 #if defined(ENABLE_ITTI)
         {
           MessageDef *message_p;
-          // Uses a new buffer to avoid issue with MAC buffer content that could be changed by MAC (asynchronous message handling).
-          u8 *message_buffer;
+          int msg_sdu_size = sizeof(RRC_MAC_CCCH_DATA_IND (message_p).sdu);
 
-          message_buffer = malloc (sdu_size);
-          memcpy (message_buffer, Sdu, sdu_size);
+          if (sdu_size > msg_sdu_size)
+          {
+            LOG_E(RRC, "SDU larger than CCCH SDU buffer size (%d, %d)", sdu_size, msg_sdu_size);
+            sdu_size = msg_sdu_size;
+          }
 
           message_p = itti_alloc_new_message (TASK_MAC_UE, RRC_MAC_CCCH_DATA_IND);
           RRC_MAC_CCCH_DATA_IND (message_p).frame = frame;
           RRC_MAC_CCCH_DATA_IND (message_p).sdu_size = sdu_size;
-          RRC_MAC_CCCH_DATA_IND (message_p).sdu_p = message_buffer;
+          memcpy (RRC_MAC_CCCH_DATA_IND (message_p).sdu, Sdu, sdu_size);
           RRC_MAC_CCCH_DATA_IND (message_p).enb_index = eNB_index;
 
           itti_send_msg_to_task (TASK_RRC_UE, Mod_id, message_p);
@@ -333,16 +411,18 @@ s8 mac_rrc_lite_data_ind(u8 Mod_id, u32 frame, u16 Srb_id, u8 *Sdu, u16 sdu_size
 #if defined(ENABLE_ITTI)
       {
         MessageDef *message_p;
-        // Uses a new buffer to avoid issue with MAC buffer content that could be changed by MAC (asynchronous message handling).
-        u8 *message_buffer;
+        int msg_sdu_size = sizeof(RRC_MAC_MCCH_DATA_IND (message_p).sdu);
 
-        message_buffer = malloc (sdu_size);
-        memcpy (message_buffer, Sdu, sdu_size);
+        if (sdu_size > msg_sdu_size)
+        {
+          LOG_E(RRC, "SDU larger than MCCH SDU buffer size (%d, %d)", sdu_size, msg_sdu_size);
+          sdu_size = msg_sdu_size;
+        }
 
         message_p = itti_alloc_new_message (TASK_MAC_UE, RRC_MAC_MCCH_DATA_IND);
         RRC_MAC_MCCH_DATA_IND (message_p).frame = frame;
         RRC_MAC_MCCH_DATA_IND (message_p).sdu_size = sdu_size;
-        RRC_MAC_MCCH_DATA_IND (message_p).sdu_p = message_buffer;
+        memcpy (RRC_MAC_MCCH_DATA_IND (message_p).sdu, Sdu, sdu_size);
         RRC_MAC_MCCH_DATA_IND (message_p).enb_index = eNB_index;
         RRC_MAC_MCCH_DATA_IND (message_p).mbsfn_sync_area = mbsfn_sync_area;
 
@@ -363,16 +443,18 @@ s8 mac_rrc_lite_data_ind(u8 Mod_id, u32 frame, u16 Srb_id, u8 *Sdu, u16 sdu_size
 #if defined(ENABLE_ITTI)
         {
           MessageDef *message_p;
-          // Uses a new buffer to avoid issue with MAC buffer content that could be changed by MAC (asynchronous message handling).
-          u8 *message_buffer;
+          int msg_sdu_size = sizeof(RRC_MAC_CCCH_DATA_IND (message_p).sdu);
 
-          message_buffer = malloc (sdu_size);
-          memcpy (message_buffer, Sdu, sdu_size);
+          if (sdu_size > msg_sdu_size)
+          {
+            LOG_E(RRC, "SDU larger than CCCH SDU buffer size (%d, %d)", sdu_size, msg_sdu_size);
+            sdu_size = msg_sdu_size;
+          }
 
           message_p = itti_alloc_new_message (TASK_MAC_ENB, RRC_MAC_CCCH_DATA_IND);
           RRC_MAC_CCCH_DATA_IND (message_p).frame = frame;
           RRC_MAC_CCCH_DATA_IND (message_p).sdu_size = sdu_size;
-          RRC_MAC_CCCH_DATA_IND (message_p).sdu_p = message_buffer;
+          memcpy (RRC_MAC_CCCH_DATA_IND (message_p).sdu, Sdu, sdu_size);
 
           itti_send_msg_to_task (TASK_RRC_ENB, Mod_id, message_p);
       }
@@ -532,8 +614,8 @@ int mac_ue_ccch_success_ind(u8 Mod_id, u8 eNB_index) {
   {
     MessageDef *message_p;
 
-    message_p = itti_alloc_new_message (TASK_MAC_UE, RRC_MAC_CCCH_SUCCESS_IND);
-    RRC_MAC_CCCH_SUCCESS_IND (message_p).enb_index = eNB_index;
+    message_p = itti_alloc_new_message (TASK_MAC_UE, RRC_MAC_CCCH_DATA_CNF);
+    RRC_MAC_CCCH_DATA_CNF (message_p).enb_index = eNB_index;
 
     itti_send_msg_to_task (TASK_RRC_UE, Mod_id - NB_eNB_INST, message_p);
   }
diff --git a/openair2/RRC/LITE/rrc_UE.c b/openair2/RRC/LITE/rrc_UE.c
index f2a9ffc4e7f5c25a1ddb86b55c5f94c6b33e4656..7275c8a29012e0023ca40df90c99f4bcbb6454ed 100644
--- a/openair2/RRC/LITE/rrc_UE.c
+++ b/openair2/RRC/LITE/rrc_UE.c
@@ -1805,11 +1805,16 @@ void *rrc_ue_task(void *args_p) {
               RRC_MAC_BCCH_DATA_IND (msg_p).frame, RRC_MAC_BCCH_DATA_IND (msg_p).enb_index);
 
         decode_BCCH_DLSCH_Message (instance, RRC_MAC_BCCH_DATA_IND (msg_p).frame,
-                                   RRC_MAC_BCCH_DATA_IND (msg_p).enb_index, RRC_MAC_BCCH_DATA_IND (msg_p).sdu_p,
+                                   RRC_MAC_BCCH_DATA_IND (msg_p).enb_index, RRC_MAC_BCCH_DATA_IND (msg_p).sdu,
                                    RRC_MAC_BCCH_DATA_IND (msg_p).sdu_size);
+        break;
 
-        // Message buffer has been processed, free it now.
-        free (RRC_MAC_BCCH_DATA_IND (msg_p).sdu_p);
+      case RRC_MAC_CCCH_DATA_CNF:
+        LOG_D(RRC, "Received %s: instance %d, eNB %d\n", msg_name, instance,
+              RRC_MAC_CCCH_DATA_CNF (msg_p).enb_index);
+
+        // reset the tx buffer to indicate RRC that ccch was successfully transmitted (for example if contention resolution succeeds)
+        UE_rrc_inst[instance].Srb0[RRC_MAC_CCCH_DATA_CNF (msg_p).enb_index].Tx_buffer.payload_size = 0;
         break;
 
       case RRC_MAC_CCCH_DATA_IND:
@@ -1818,22 +1823,11 @@ void *rrc_ue_task(void *args_p) {
 
         srb_info_p = &UE_rrc_inst[instance].Srb0[RRC_MAC_CCCH_DATA_IND (msg_p).enb_index];
 
-        memcpy (srb_info_p->Rx_buffer.Payload, RRC_MAC_CCCH_DATA_IND (msg_p).sdu_p,
+        memcpy (srb_info_p->Rx_buffer.Payload, RRC_MAC_CCCH_DATA_IND (msg_p).sdu,
                 RRC_MAC_CCCH_DATA_IND (msg_p).sdu_size);
         srb_info_p->Rx_buffer.payload_size = RRC_MAC_CCCH_DATA_IND (msg_p).sdu_size;
         rrc_ue_decode_ccch (instance, RRC_MAC_CCCH_DATA_IND (msg_p).frame, srb_info_p,
                             RRC_MAC_CCCH_DATA_IND (msg_p).enb_index);
-
-        // Message buffer has been processed, free it now.
-        free (RRC_MAC_CCCH_DATA_IND (msg_p).sdu_p);
-        break;
-
-      case RRC_MAC_CCCH_SUCCESS_IND:
-        LOG_D(RRC, "Received %s: instance %d, eNB %d\n", msg_name, instance,
-              RRC_MAC_CCCH_SUCCESS_IND (msg_p).enb_index);
-
-        // reset the tx buffer to indicate RRC that ccch was successfully transmitted (for example if contention resolution succeeds)
-        UE_rrc_inst[instance].Srb0[RRC_MAC_CCCH_SUCCESS_IND (msg_p).enb_index].Tx_buffer.payload_size = 0;
         break;
 
 #ifdef Rel10
@@ -1842,11 +1836,8 @@ void *rrc_ue_task(void *args_p) {
               RRC_MAC_MCCH_DATA_IND (msg_p).frame, RRC_MAC_MCCH_DATA_IND (msg_p).enb_index, RRC_MAC_MCCH_DATA_IND (msg_p).mbsfn_sync_area);
 
         decode_MCCH_Message (instance, RRC_MAC_MCCH_DATA_IND (msg_p).frame, RRC_MAC_MCCH_DATA_IND (msg_p).enb_index,
-                             RRC_MAC_MCCH_DATA_IND (msg_p).sdu_p, RRC_MAC_MCCH_DATA_IND (msg_p).sdu_size,
+                             RRC_MAC_MCCH_DATA_IND (msg_p).sdu, RRC_MAC_MCCH_DATA_IND (msg_p).sdu_size,
                              RRC_MAC_MCCH_DATA_IND (msg_p).mbsfn_sync_area);
-
-        // Message buffer has been processed, free it now.
-        free (RRC_MAC_MCCH_DATA_IND (msg_p).sdu_p);
         break;
 #endif
 
diff --git a/openair2/RRC/LITE/rrc_eNB.c b/openair2/RRC/LITE/rrc_eNB.c
index 6d21563d7eb014fd4152850d4b648f0f4d95c8e4..e6c7cf890032e31f9d4d9d8e1eae062bea9d32c3 100644
--- a/openair2/RRC/LITE/rrc_eNB.c
+++ b/openair2/RRC/LITE/rrc_eNB.c
@@ -2020,13 +2020,10 @@ void *rrc_enb_task(void *args_p) {
 
         srb_info_p = &eNB_rrc_inst[instance].Srb0;
 
-        memcpy (srb_info_p->Rx_buffer.Payload, RRC_MAC_CCCH_DATA_IND (msg_p).sdu_p,
+        memcpy (srb_info_p->Rx_buffer.Payload, RRC_MAC_CCCH_DATA_IND (msg_p).sdu,
                 RRC_MAC_CCCH_DATA_IND (msg_p).sdu_size);
         srb_info_p->Rx_buffer.payload_size = RRC_MAC_CCCH_DATA_IND (msg_p).sdu_size;
         rrc_eNB_decode_ccch (instance, RRC_MAC_CCCH_DATA_IND (msg_p).frame, srb_info_p);
-
-        // Message buffer has been processed, free it now.
-        free (RRC_MAC_CCCH_DATA_IND (msg_p).sdu_p);
         break;
 
       case RRC_DCCH_DATA_IND: