cellular-infrastructure
/
osmo-bts
mirror of https://gerrit.osmocom.org/osmo-bts
9
0
Fork 0
Code Issues Releases Wiki Activity

cbch: Fix bts_smscb_state_reset() to avoid double-free 

If the currently transmitted message is the default message,
bts_ss->cur_msg == bts_ss->derfault_msg.  In this case we cannot
simply talloc_free() both of them, as it would result in a boudle-free.

Change-Id: I2d3645e34d31507b012a53ffe12d14223682f808
Closes: OS#5325
Fixes: Ib01d38c59ba9fa083fcc0682009c13d2db3664fe
This commit is contained in:
Harald Welte 2021-11-24 20:00:29 +01:00
parent 40e97f3d02
commit 79f21c4ed1
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/common/cbch.c
View File

@ -332,7 +332,10 @@ static void bts_smscb_state_reset(struct bts_smscb_state *bts_ss)
}
bts_ss->queue_len = 0;
rate_ctr_group_reset(bts_ss->ctrs);
TALLOC_FREE(bts_ss->cur_msg);
/* avoid double-free of default_msg in case cur_msg == default_msg */
if (bts_ss->cur_msg && bts_ss->cur_msg != bts_ss->default_msg)
talloc_free(bts_ss->cur_msg);
bts_ss->cur_msg = NULL;
TALLOC_FREE(bts_ss->default_msg);
}