Change in osmo-bts[master]: cbch: Fix memory leak and send error message on invalid SMSCB command

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

Harald Welte gerrit-no-reply at lists.osmocom.org
Tue May 21 18:14:20 UTC 2019


Harald Welte has submitted this change and it was merged. ( https://gerrit.osmocom.org/14101 )

Change subject: cbch: Fix memory leak and send error message on invalid SMSCB command
......................................................................

cbch: Fix memory leak and send error message on invalid SMSCB command

Change-Id: I411d1fb3693a2f7cf7bba3d38b1aaf276a4137ba
Related: OS#4011
---
M src/common/cbch.c
M src/common/rsl.c
2 files changed, 10 insertions(+), 3 deletions(-)

Approvals:
  Jenkins Builder: Verified
  Vadim Yanitskiy: Looks good to me, approved



diff --git a/src/common/cbch.c b/src/common/cbch.c
index 185386a..c75b510 100644
--- a/src/common/cbch.c
+++ b/src/common/cbch.c
@@ -182,6 +182,9 @@
 			talloc_free(scm);
 		}
 		break;
+	default:
+		talloc_free(scm);
+		return -EINVAL;
 	}
 
 	return 0;
diff --git a/src/common/rsl.c b/src/common/rsl.c
index 76aaef3..8021d2d 100644
--- a/src/common/rsl.c
+++ b/src/common/rsl.c
@@ -487,6 +487,7 @@
 	struct abis_rsl_cchan_hdr *cch = msgb_l2(msg);
 	struct tlv_parsed tp;
 	struct rsl_ie_cb_cmd_type *cb_cmd_type;
+	int rc;
 
 	rsl_tlv_parse(&tp, msgb_l3(msg), msgb_l3len(msg));
 
@@ -497,9 +498,12 @@
 	cb_cmd_type = (struct rsl_ie_cb_cmd_type *)
 					TLVP_VAL(&tp, RSL_IE_CB_CMD_TYPE);
 
-	return bts_process_smscb_cmd(trx->bts, *cb_cmd_type,
-				     TLVP_LEN(&tp, RSL_IE_SMSCB_MSG),
-				     TLVP_VAL(&tp, RSL_IE_SMSCB_MSG));
+	rc = bts_process_smscb_cmd(trx->bts, *cb_cmd_type, TLVP_LEN(&tp, RSL_IE_SMSCB_MSG),
+				   TLVP_VAL(&tp, RSL_IE_SMSCB_MSG));
+	if (rc < 0)
+		return rsl_tx_error_report(trx, RSL_ERR_IE_CONTENT, &cch->chan_nr, NULL, msg);
+
+	return 0;
 }
 
 /*! Prefix a given SACCH frame with a L2/LAPDm UI header and store it in given output buffer.

-- 
To view, visit https://gerrit.osmocom.org/14101
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I411d1fb3693a2f7cf7bba3d38b1aaf276a4137ba
Gerrit-Change-Number: 14101
Gerrit-PatchSet: 2
Gerrit-Owner: Harald Welte <laforge at gnumonks.org>
Gerrit-Reviewer: Harald Welte <laforge at gnumonks.org>
Gerrit-Reviewer: Jenkins Builder (1000002)
Gerrit-Reviewer: Vadim Yanitskiy <axilirator at gmail.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20190521/fa834a5a/attachment.htm>


More information about the gerrit-log mailing list