fixeria has submitted this change. (
https://gerrit.osmocom.org/c/osmo-msc/+/39868?usp=email )
Change subject: gsm0911_gsup_rx(): invalidate vsub pointer
......................................................................
gsm0911_gsup_rx(): invalidate vsub pointer
Calling vlr_subscr_put() in gsm0911_gsup_rx() may result in free()ing
the memory pointed by vsub, so let's set it to NULL to prevent
potential use-after-free.
Change-Id: If81df71a52e4fa972b48c61d1ed1361c6629ae94
---
M src/libmsc/gsm_09_11.c
1 file changed, 1 insertion(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
pespin: Looks good to me, but someone else must approve
laforge: Looks good to me, approved
diff --git a/src/libmsc/gsm_09_11.c b/src/libmsc/gsm_09_11.c
index 0b85cbd..442995e 100644
--- a/src/libmsc/gsm_09_11.c
+++ b/src/libmsc/gsm_09_11.c
@@ -503,6 +503,7 @@
/* We don't need subscriber info anymore */
vlr_subscr_put(vsub, __func__);
+ vsub = NULL;
/* (Re)schedule the inactivity timer */
if (net->ncss_guard_timeout > 0) {
--
To view, visit
https://gerrit.osmocom.org/c/osmo-msc/+/39868?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-msc
Gerrit-Branch: master
Gerrit-Change-Id: If81df71a52e4fa972b48c61d1ed1361c6629ae94
Gerrit-Change-Number: 39868
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>