From 35706ddd80c248a9ef26e702c81e9865a7b8cf6d Mon Sep 17 00:00:00 2001 From: Neels Hofmeyr Date: Thu, 22 Dec 2016 01:58:03 +0100 Subject: [PATCH] gsm0408_rcv_cc: guard against NULL subscriber Check conn->subscr against NULL. gsm0408_rcv_cc() dereferences many conn members without checking presence: the bts and lchan members may be expected to be NULL in the ongoing MSC split and 3G developments. But the conn->subscr is initially NULL, so an MS sending a CC message before something like a LU or CM Service Request will result in a segfault. Prevent that. Note: the upcoming VLR will be more restrictive on what messages are processed, this is a "backport" to the situation on current master. Change-Id: If067db7cc0dd3210d9eb1da15be6b637795a3ecf --- openbsc/src/libmsc/gsm_04_08.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/openbsc/src/libmsc/gsm_04_08.c b/openbsc/src/libmsc/gsm_04_08.c index 1e2575492..838071006 100644 --- a/openbsc/src/libmsc/gsm_04_08.c +++ b/openbsc/src/libmsc/gsm_04_08.c @@ -3605,6 +3605,11 @@ static int gsm0408_rcv_cc(struct gsm_subscriber_connection *conn, struct msgb *m return -EINVAL; } + if (!conn->subscr) { + LOGP(DCC, LOGL_ERROR, "Invalid conn, no subscriber\n"); + return -EINVAL; + } + /* Find transaction */ trans = trans_find_by_id(conn, GSM48_PDISC_CC, transaction_id);