Change in osmocom-bb[master]: mobile/gsm322: fix use-after-free of cs->si reported by ASan

[laforge]

laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmocom-bb/+/17302 )

Change subject: mobile/gsm322: fix use-after-free of cs->si reported by ASan
......................................................................

mobile/gsm322: fix use-after-free of cs->si reported by ASan

This pointer cs->si stores an address to the System Information of
a currently selected cell. When we release System Information,
ensure that it does not point to free()d memory.

Change-Id: Ife2ddf7274a48447a9ded9035f9dd01befaf2e6c
---
M src/host/layer23/src/mobile/gsm322.c
1 file changed, 7 insertions(+), 0 deletions(-)

Approvals:
  Jenkins Builder: Verified
  pespin: Looks good to me, but someone else must approve
  laforge: Looks good to me, approved



diff --git a/src/host/layer23/src/mobile/gsm322.c b/src/host/layer23/src/mobile/gsm322.c
index ddb3a77..cc4f0cd 100644
--- a/src/host/layer23/src/mobile/gsm322.c
+++ b/src/host/layer23/src/mobile/gsm322.c
@@ -2635,6 +2635,8 @@
 			if (cs->list[cs->arfci].sysinfo) {
 				LOGP(DCS, LOGL_DEBUG, "free sysinfo arfcn=%s\n",
 					gsm_print_arfcn(cs->arfcn));
+				if (cs->si == cs->list[cs->arfci].sysinfo)
+					cs->si = NULL;
 				talloc_free(cs->list[cs->arfci].sysinfo);
 				cs->list[cs->arfci].sysinfo = NULL;
 			}
@@ -2752,6 +2754,8 @@
 	if (cs->list[cs->arfci].sysinfo) {
 		LOGP(DCS, LOGL_DEBUG, "free sysinfo arfcn=%s\n",
 			gsm_print_arfcn(cs->arfcn));
+		if (cs->si == cs->list[cs->arfci].sysinfo)
+			cs->si = NULL;
 		talloc_free(cs->list[cs->arfci].sysinfo);
 		cs->list[cs->arfci].sysinfo = NULL;
 	}
@@ -2919,6 +2923,8 @@
 			cs->list[i].flags &= ~GSM322_CS_FLAG_SYSINFO;
 			LOGP(DCS, LOGL_DEBUG, "free sysinfo ARFCN=%s\n",
 				gsm_print_arfcn(index2arfcn(i)));
+			if (cs->si == cs->list[i].sysinfo)
+				cs->si = NULL;
 			talloc_free(cs->list[i].sysinfo);
 			cs->list[i].sysinfo = NULL;
 		}
@@ -5145,6 +5151,7 @@
 				gsm_print_arfcn(index2arfcn(i)));
 			talloc_free(cs->list[i].sysinfo);
 			cs->list[i].sysinfo = NULL;
+			cs->si = NULL;
 		}
 		cs->list[i].flags = 0;
 	}

-- 
To view, visit https://gerrit.osmocom.org/c/osmocom-bb/+/17302
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmocom-bb
Gerrit-Branch: master
Gerrit-Change-Id: Ife2ddf7274a48447a9ded9035f9dd01befaf2e6c
Gerrit-Change-Number: 17302
Gerrit-PatchSet: 1
Gerrit-Owner: Vadim Yanitskiy <axilirator at gmail.com>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge at osmocom.org>
Gerrit-Reviewer: pespin <pespin at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20200301/6655fa69/attachment.htm>