cellular-infrastructure
/
osmo-sgsn
mirror of https://gerrit.osmocom.org/osmo-sgsn
9
0
Fork 0
Code Issues Releases Wiki Activity

gprs: Fix GSUP cancel_type handling (Coverity) 

When handling an incoming GSUP cancellation request, the cancel_type
if effectively ignored, such that is always handled as
GPRS_GSUP_CANCEL_TYPE_UPDATE and never as WITHDRAW.

This commit fixes the expression used to set the variable
is_update_procedure.

Fixes: Coverity CID 1267739
Sponsored-by: On-Waves ehf
This commit is contained in:
Jacob Erlbeck 2015-04-07 17:49:48 +02:00 committed by Holger Hans Peter Freyther
parent 9ed6fd25dd
commit 5b51205187
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
openbsc/src/gprs/gprs_subscriber.c
View File

@ -492,7 +492,8 @@ static int gprs_subscr_handle_loc_cancel_req(struct gsm_subscriber *subscr,
struct gprs_gsup_message *gsup_msg)
{
struct gprs_gsup_message gsup_reply = {0};
int is_update_procedure = !gsup_msg->cancel_type || gsup_msg->cancel_type;
int is_update_procedure = !gsup_msg->cancel_type ||
gsup_msg->cancel_type == GPRS_GSUP_CANCEL_TYPE_UPDATE;
LOGGSUBSCRP(LOGL_INFO, subscr, "Cancelling MS subscriber (%s)\n",
is_update_procedure ?

12
openbsc/tests/sgsn/sgsn_test.c
View File

@ -440,6 +440,12 @@ static void test_subscriber_gsup(void)
0x06, 0x01, 0x00,
};
static const uint8_t location_cancellation_req_withdraw[] = {
0x1c,
TEST_GSUP_IMSI1_IE,
0x06, 0x01, 0x01,
};
static const uint8_t location_cancellation_req_other[] = {
0x1c,
0x01, 0x05, 0x11, 0x11, 0x11, 0x11, 0x01,
@ -582,6 +588,12 @@ static void test_subscriber_gsup(void)
OSMO_ASSERT(s1->flags & GPRS_SUBSCRIBER_CANCELLED);
OSMO_ASSERT(s1->sgsn_data->mm == NULL);
/* Inject LocCancelReq(withdraw) GSUP message */
rc = rx_gsup_message(location_cancellation_req_withdraw,
sizeof(location_cancellation_req_withdraw));
OSMO_ASSERT(rc >= 0);
OSMO_ASSERT(s1->sgsn_data->error_cause == GMM_CAUSE_IMPL_DETACHED);
/* Inject PurgeMsRes GSUP message */
rc = rx_gsup_message(purge_ms_res,
sizeof(purge_ms_res));