fixeria has uploaded this change for review.

View Change

gsm0911_gsup_rx(): invalidate vsub pointer

Calling vlr_subscr_put() in gsm0911_gsup_rx() may result in free()ing
the memory pointed by vsub, so let's set it to NULL to prevent
potential use-after-free.

Change-Id: If81df71a52e4fa972b48c61d1ed1361c6629ae94
---
M src/libmsc/gsm_09_11.c
1 file changed, 1 insertion(+), 0 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/68/39868/1

diff --git a/src/libmsc/gsm_09_11.c b/src/libmsc/gsm_09_11.c
index 0b85cbd..442995e 100644
--- a/src/libmsc/gsm_09_11.c
+++ b/src/libmsc/gsm_09_11.c
@@ -503,6 +503,7 @@
 
 	/* We don't need subscriber info anymore */
 	vlr_subscr_put(vsub, __func__);
+	vsub = NULL;
 
 	/* (Re)schedule the inactivity timer */
 	if (net->ncss_guard_timeout > 0) {

To view, visit change 39868. To unsubscribe, or for help writing mail filters, visit settings.