From cee5a2878bd7311115b144b6ff372481e1c2fad6 Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Sat, 26 Dec 2015 08:43:31 +0100 Subject: [PATCH] don't double-free msgb's in rua_helper and ranap_common_cn --- src/tests/ranap_common_cn.c | 5 ++--- src/tests/rua_helper.c | 8 +------- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/src/tests/ranap_common_cn.c b/src/tests/ranap_common_cn.c index a26df037..be0c5833 100644 --- a/src/tests/ranap_common_cn.c +++ b/src/tests/ranap_common_cn.c @@ -27,8 +27,9 @@ #include "ranap_common.h" #include "ranap_ies_defs.h" +#include "ranap_common_cn.h" -#include "cn_ranap_common.h" +#include "hnbgw.h" static int cn_ranap_rx_initiating_msg_co(void *ctx, RANAP_InitiatingMessage_t *imsg, ranap_message *message) @@ -148,7 +149,6 @@ int cn_ranap_rx_co(void *ctx, uint8_t *data, size_t len) memset(&message, 0, sizeof(message)); - memset(pdu, 0, sizeof(*pdu)); dec_ret = aper_decode(NULL,&asn_DEF_RANAP_RANAP_PDU, (void **) &pdu, data, len, 0, 0); if (dec_ret.code != RC_OK) { @@ -282,7 +282,6 @@ int cn_ranap_rx_cl(void *ctx, uint8_t *data, size_t len) memset(&message, 0, sizeof(message)); - memset(pdu, 0, sizeof(*pdu)); dec_ret = aper_decode(NULL,&asn_DEF_RANAP_RANAP_PDU, (void **) &pdu, data, len, 0, 0); if (dec_ret.code != RC_OK) { diff --git a/src/tests/rua_helper.c b/src/tests/rua_helper.c index 70e7724a..d1dcbf69 100644 --- a/src/tests/rua_helper.c +++ b/src/tests/rua_helper.c @@ -58,8 +58,6 @@ struct msgb *rua_new_conn(int is_ps, uint32_t context_id, struct msgb *inmsg) if (rc < 0) return NULL; - msgb_free(inmsg); - msg = rua_generate_initiating_message(RUA_ProcedureCode_id_Connect, RUA_Criticality_reject, &asn_DEF_RUA_Connect, @@ -96,8 +94,6 @@ struct msgb *rua_new_dt(int is_ps, uint32_t context_id, struct msgb *inmsg) if (rc < 0) return NULL; - msgb_free(inmsg); - msg = rua_generate_initiating_message(RUA_ProcedureCode_id_DirectTransfer, RUA_Criticality_reject, &asn_DEF_RUA_DirectTransfer, @@ -132,16 +128,14 @@ struct msgb *rua_new_disc(int is_ps, uint32_t context_id, struct msgb *inmsg) if (inmsg && inmsg->data&& msgb_length(inmsg)) { ies.presenceMask |= DISCONNECTIES_RUA_RANAP_MESSAGE_PRESENT; OCTET_STRING_fromBuf(&ies.ranaP_Message.buf, inmsg->data, msgb_length(inmsg)); - msgb_free(inmsg); } + msgb_free(inmsg); memset(&out, 0, sizeof(out)); rc = rua_encode_disconnecties(&out, &ies); if (rc < 0) return NULL; - msgb_free(inmsg); - msg = rua_generate_initiating_message(RUA_ProcedureCode_id_Disconnect, RUA_Criticality_reject, &asn_DEF_RUA_Disconnect,