From: Holger Hans Peter Freyther <holger(a)moiji-mobile.com>
In case the SMPP payload didn't include the right fields we
would leak the subscr reference count.
---
openbsc/src/libmsc/smpp_openbsc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/openbsc/src/libmsc/smpp_openbsc.c b/openbsc/src/libmsc/smpp_openbsc.c
index 057a9d0..a2fa0f4 100644
--- a/openbsc/src/libmsc/smpp_openbsc.c
+++ b/openbsc/src/libmsc/smpp_openbsc.c
@@ -110,6 +110,7 @@ static int submit_to_sms(struct gsm_sms **psms, struct gsm_network
*net,
/* ERROR: we cannot have both! */
LOGP(DLSMS, LOGL_ERROR, "SMPP Cannot have payload in "
"TLV _and_ in the header\n");
+ subscr_put(dest);
return ESME_ROPTPARNOTALLWD;
}
sms_msg = t->value.octet;
@@ -120,6 +121,7 @@ static int submit_to_sms(struct gsm_sms **psms, struct gsm_network
*net,
} else {
LOGP(DLSMS, LOGL_ERROR,
"SMPP neither message payload nor valid sm_length.\n");
+ subscr_put(dest);
return ESME_RINVPARLEN;
}
--
2.3.5