From 86f212666a1967d0f9ebbcf0efa6976daabf7af6 Mon Sep 17 00:00:00 2001 From: Pau Espin Pedrol Date: Tue, 24 Apr 2018 14:02:01 +0200 Subject: [PATCH] setup_trig_pag_evt: Fix heap-use-after-free Catched by osmo-gsm-tester running test voice:octphy. Fixes following AddressSanitizer report: ==18864==ERROR: AddressSanitizer: heap-use-after-free on address 0x61a000016f18 at pc 0x55f1b29eee5c bp 0x7ffdaa2ac000 sp 0x7ffdaa2abff8 WRITE of size 8 at 0x61a000016f18 thread T0 #0 0x55f1b29eee5b in setup_trig_pag_evt osmo-msc/src/libmsc/gsm_04_08.c:1490 #1 0x55f1b2a086c1 in subscr_paging_dispatch osmo-msc/src/libmsc/gsm_subscriber.c:101 #2 0x7fb88e07c1c9 in osmo_timers_update libosmocore/src/timer.c:257 #3 0x7fb88e07f1b1 in osmo_select_main libosmocore/src/select.c:253 #4 0x55f1b29b600b in main osmo-msc/msc_main.c:694 #5 0x7fb88bebe2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0) #6 0x55f1b29b69f9 in _start (osmo-msc/bin/osmo-msc+0xf09f9) Related: OS#3198 Change-Id: Ie7fdca4d48e247c77a53e81aec2b6bacd8fef678 --- src/libmsc/gsm_04_08.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libmsc/gsm_04_08.c b/src/libmsc/gsm_04_08.c index 27aff5510..5c453165c 100644 --- a/src/libmsc/gsm_04_08.c +++ b/src/libmsc/gsm_04_08.c @@ -1467,6 +1467,7 @@ static int setup_trig_pag_evt(unsigned int hooknum, unsigned int event, OSMO_ASSERT(conn); /* Assign conn */ transt->conn = msc_subscr_conn_get(conn, MSC_CONN_USE_TRANS_CC); + transt->paging_request = NULL; /* send SETUP request to called party */ gsm48_cc_tx_setup(transt, &transt->cc.msg); break; @@ -1486,7 +1487,6 @@ static int setup_trig_pag_evt(unsigned int hooknum, unsigned int event, break; } - transt->paging_request = NULL; return 0; }