neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-hnbgw/+/32525 )

Change subject: fix asn1 leak in error path of hnbgw_tx_ue_register_acc_tmsi() ......................................................................

fix asn1 leak in error path of hnbgw_tx_ue_register_acc_tmsi()

Related: SYS#6297 Change-Id: Iad1519aea36d8b6fef51fedb22a861ad1bc462fc --- M src/osmo-hnbgw/hnbgw_hnbap.c 1 file changed, 27 insertions(+), 14 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/osmo-hnbgw refs/changes/25/32525/1

diff --git a/src/osmo-hnbgw/hnbgw_hnbap.c b/src/osmo-hnbgw/hnbgw_hnbap.c index bc3dccd..980c6b0 100644 --- a/src/osmo-hnbgw/hnbgw_hnbap.c +++ b/src/osmo-hnbgw/hnbgw_hnbap.c @@ -338,19 +338,8 @@

memset(&accept_out, 0, sizeof(accept_out)); rc = hnbap_encode_ueregisteraccepties(&accept_out, &accept); - if (rc < 0) { - /* If we allocated the UE context but the UE REGISTER fails, get rid of it again: there will likely - * never be a UE DE-REGISTER for this UE from the HNB, and the ue_context would linger forever. */ - if (ue_allocated) - ue_context_free(ue_allocated); - return rc; - }

- msg = hnbap_generate_successful_outcome(HNBAP_ProcedureCode_id_UERegister, - HNBAP_Criticality_reject, - &asn_DEF_HNBAP_UERegisterAccept, - &accept_out); - + /* free 'accept', now encoded in 'accept_out' */ switch (ue_id->present) { case HNBAP_UE_Identity_PR_tMSILAI: ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_BIT_STRING, @@ -377,9 +366,23 @@ break; }

- ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_HNBAP_UERegisterAccept, &accept_out); + if (rc < 0) { + /* Encoding failed. Nothing in 'accept_out'. */ + /* If we allocated the UE context but the UE REGISTER fails, get rid of it again: there will likely + * never be a UE DE-REGISTER for this UE from the HNB, and the ue_context would linger forever. */ + if (ue_allocated) + ue_context_free(ue_allocated); + return rc; + }

- return hnbgw_hnbap_tx(hnb, msg); + /* Encoding successful, transmit, then free 'accept_out'. */ + msg = hnbap_generate_successful_outcome(HNBAP_ProcedureCode_id_UERegister, + HNBAP_Criticality_reject, + &asn_DEF_HNBAP_UERegisterAccept, + &accept_out); + rc = hnbgw_hnbap_tx(hnb, msg); + ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_HNBAP_UERegisterAccept, &accept_out); + return rc; }

static int hnbgw_rx_hnb_deregister(struct hnb_context *ctx, ANY_t *in)