pespin submitted this change.

View Change

route: Fix rt pointer use-after-free

The code path is accessing the integer fields of a struct just freed.

Fixes: 64e70ab8c20b5acc8e4717d5bcb08fcecf46bd98
Change-Id: I7966c554f1ce92946e828afeb1e07c735be341bf
---
M src/osmo_ss7_route.c
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/osmo_ss7_route.c b/src/osmo_ss7_route.c
index 32e3eb7..dc48e28 100644
--- a/src/osmo_ss7_route.c
+++ b/src/osmo_ss7_route.c
@@ -228,7 +228,7 @@
 	/* Keep old behavior, return already existing route: */
 	if (rc == -EADDRINUSE) {
 		talloc_free(rt);
-		return ss7_route_table_find_route_by_dpc_mask(rtbl, rt->cfg.pc, rt->cfg.mask);
+		return ss7_route_table_find_route_by_dpc_mask(rtbl, pc, mask);
 	}
 
 	return rt;

To view, visit change 38728. To unsubscribe, or for help writing mail filters, visit settings.