Harald Welte has submitted this change and it was merged.

Change subject: fix: clear vlr_subscr->msc_conn_ref when the conn is discarded
......................................................................


fix: clear vlr_subscr->msc_conn_ref when the conn is discarded

Before this, it was for example possible to crash the MSC by the vty 'show
subscriber' command, which would dereference a potentially stale
vsub->msc_conn_ref pointer.

Related: OS#3050
Change-Id: Ia4105d9f135ba3216ad3c86157be7658b1d568fb
---
M src/libmsc/osmo_msc.c
1 file changed, 1 insertion(+), 0 deletions(-)

Approvals:
  Harald Welte: Looks good to me, approved
  Jenkins Builder: Verified



diff --git a/src/libmsc/osmo_msc.c b/src/libmsc/osmo_msc.c
index 1478c19..f6df0d2 100644
--- a/src/libmsc/osmo_msc.c
+++ b/src/libmsc/osmo_msc.c
@@ -228,6 +228,7 @@
                DEBUGP(DRLL, "subscr %s: Freeing subscriber connection\n",
                       vlr_subscr_name(conn->vsub));
                msc_subscr_cleanup(conn->vsub);
+               conn->vsub->msc_conn_ref = NULL;
                vlr_subscr_put(conn->vsub);
                conn->vsub = NULL;
        } else

-- 
To view, visit https://gerrit.osmocom.org/7176
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: Ia4105d9f135ba3216ad3c86157be7658b1d568fb
Gerrit-PatchSet: 3
Gerrit-Project: osmo-msc
Gerrit-Branch: master
Gerrit-Owner: Neels Hofmeyr <nhofm...@sysmocom.de>
Gerrit-Reviewer: Harald Welte <lafo...@gnumonks.org>
Gerrit-Reviewer: Jenkins Builder

Reply via email to