Change in osmo-bsc[pespin/1.7.1]: lchan_fsm: fix potential NULL-pointer dereference

[pespin]

Hello fixeria,

I'd like you to do a code review. Please visit

    https://gerrit.osmocom.org/c/osmo-bsc/+/25843

to review the following change.


Change subject: lchan_fsm: fix potential NULL-pointer dereference
......................................................................

lchan_fsm: fix potential NULL-pointer dereference

Test case TC_lost_sdcch_during_assignment from ttcn3-bsc-test
causes osmo-bsc to crash due to for_conn being NULL.

This patch is a backport from osmo-bsc.git master
dfd7bef6644d0c0837f7e5498bc5c86362b668dc.

Change-Id: I373855b95f8bde0ce8f9c2ae7bf95c9135d33484
Related: SYS#5526, OS#5255
---
M src/osmo-bsc/lchan_fsm.c
1 file changed, 12 insertions(+), 0 deletions(-)



  git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/43/25843/1

diff --git a/src/osmo-bsc/lchan_fsm.c b/src/osmo-bsc/lchan_fsm.c
index 9c7ecaf..fb40e00 100644
--- a/src/osmo-bsc/lchan_fsm.c
+++ b/src/osmo-bsc/lchan_fsm.c
@@ -114,6 +114,18 @@
 	case FOR_ASSIGNMENT:
 		LOG_LCHAN(lchan, LOGL_NOTICE, "Signalling Assignment FSM of error (%s)\n",
 			  lchan->last_error ? : "unknown error");
+		if (!for_conn) {
+			LOG_LCHAN(lchan, LOGL_ERROR,
+				  "lchan activation for Assignment failed, but activation request has"
+				  " no conn\n");
+			break;
+		}
+		if (!for_conn->assignment.fi) {
+			LOG_LCHAN(lchan, LOGL_ERROR,
+				  "lchan activation for Assignment failed, but conn has no ongoing"
+				  " assignment procedure\n");
+			break;
+		}
 		_osmo_fsm_inst_dispatch(for_conn->assignment.fi, ASSIGNMENT_EV_LCHAN_ERROR, lchan,
 					file, line);
 		return;

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/25843
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-bsc
Gerrit-Branch: pespin/1.7.1
Gerrit-Change-Id: I373855b95f8bde0ce8f9c2ae7bf95c9135d33484
Gerrit-Change-Number: 25843
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin at sysmocom.de>
Gerrit-Reviewer: fixeria <vyanitskiy at sysmocom.de>
Gerrit-MessageType: newchange
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20211020/365e92de/attachment.htm>