[PATCH] libosmocore[master]: lapd_core: Fix crash in lapd_est_req() function

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

Ivan Kluchnikov gerrit-no-reply at lists.osmocom.org
Thu Aug 10 15:13:46 UTC 2017


Review at  https://gerrit.osmocom.org/3467

lapd_core: Fix crash in lapd_est_req() function

lapd_est_req() function could be called on uninitialized lapd link
(before lapd_dl_init() and after lapd_dl_exit() functions) due to
invalid usage on higher levels.
In order to prevent using uninitialized lapd link, we should set
LAPD_STATE_NULL state for lapd_datalink in lapd_dl_exit() function.
So all messages for lapd_datalink in null state will be unhandled by
lapd_recv_dlsap() function and lapd_est_req() function will not be
called before lapd_dl_init() function where lapd link state is changed
to idle.

Change-Id: I306dad9b78e3becaef14c5305ec25c312feefe3c
Related: OS#1982
---
M src/gsm/lapd_core.c
1 file changed, 4 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/67/3467/1

diff --git a/src/gsm/lapd_core.c b/src/gsm/lapd_core.c
index 166bf9a..6b58006 100644
--- a/src/gsm/lapd_core.c
+++ b/src/gsm/lapd_core.c
@@ -326,6 +326,10 @@
 {
 	/* free all ressources except history buffer */
 	lapd_dl_reset(dl);
+
+	/* enter null state */
+	lapd_dl_newstate(dl, LAPD_STATE_NULL);
+
 	/* free history buffer list */
 	talloc_free(dl->tx_hist);
 	dl->tx_hist = NULL;

-- 
To view, visit https://gerrit.osmocom.org/3467
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I306dad9b78e3becaef14c5305ec25c312feefe3c
Gerrit-PatchSet: 1
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Owner: Ivan Kluchnikov <kluchnikovi at gmail.com>



More information about the gerrit-log mailing list