From 703d686c20f82e856762bffef01a6f4bb021dc9e Mon Sep 17 00:00:00 2001
From: Harald Welte <laforge@gnumonks.org>
Date: Mon, 24 Sep 2018 17:44:50 +0200
Subject: [PATCH] fix double-free of msgb

Change-Id: I3eefed9ed2954a378327569949c944847e78dcf3
---
 src/remsim_client.c | 1 -
 src/rspro_util.c    | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/remsim_client.c b/src/remsim_client.c
index e04d2ef..850ded6 100644
--- a/src/remsim_client.c
+++ b/src/remsim_client.c
@@ -73,7 +73,6 @@ int bankd_read_cb(struct ipa_client_conn *conn, struct msgb *msg)
 	printf("Received RSPRO %s\n", msgb_hexdump(msg));
 
 	rc = bankd_handle_msg(bc, msg);
-	msgb_free(msg);
 
 	return rc;
 
diff --git a/src/rspro_util.c b/src/rspro_util.c
index 82adb88..002bd81 100644
--- a/src/rspro_util.c
+++ b/src/rspro_util.c
@@ -39,6 +39,7 @@ struct msgb *rspro_enc_msg(RsproPDU_t *pdu)
 	rval = der_encode_to_buffer(&asn_DEF_RsproPDU, pdu, msgb_data(msg), msgb_tailroom(msg));
 	if (rval.encoded < 0) {
 		fprintf(stderr, "Failed to encode %s\n", rval.failed_type->name);
+		msgb_free(msg);
 		return NULL;
 	}
 	msgb_put(msg, rval.encoded);