aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHarald Welte <laforge@gnumonks.org>2019-05-20 14:33:45 +0200
committerHarald Welte <laforge@gnumonks.org>2019-05-21 00:31:11 +0200
commit89bfea63c9e4e3a308288fcb98e48bf88919e246 (patch)
tree031d963792e327a67041618065938a62dbc991b0
parent5567d71d39d051cbf9aa4fe744a0d0b65bb56fdc (diff)
cbch: Fix memory leak and send error message on invalid SMSCB command
-rw-r--r--src/common/cbch.c3
-rw-r--r--src/common/rsl.c10
2 files changed, 10 insertions, 3 deletions
diff --git a/src/common/cbch.c b/src/common/cbch.c
index 185386ab..c75b5102 100644
--- a/src/common/cbch.c
+++ b/src/common/cbch.c
@@ -182,6 +182,9 @@ int bts_process_smscb_cmd(struct gsm_bts *bts,
talloc_free(scm);
}
break;
+ default:
+ talloc_free(scm);
+ return -EINVAL;
}
return 0;
diff --git a/src/common/rsl.c b/src/common/rsl.c
index 76aaef33..8021d2d4 100644
--- a/src/common/rsl.c
+++ b/src/common/rsl.c
@@ -487,6 +487,7 @@ static int rsl_rx_sms_bcast_cmd(struct gsm_bts_trx *trx, struct msgb *msg)
struct abis_rsl_cchan_hdr *cch = msgb_l2(msg);
struct tlv_parsed tp;
struct rsl_ie_cb_cmd_type *cb_cmd_type;
+ int rc;
rsl_tlv_parse(&tp, msgb_l3(msg), msgb_l3len(msg));
@@ -497,9 +498,12 @@ static int rsl_rx_sms_bcast_cmd(struct gsm_bts_trx *trx, struct msgb *msg)
cb_cmd_type = (struct rsl_ie_cb_cmd_type *)
TLVP_VAL(&tp, RSL_IE_CB_CMD_TYPE);
- return bts_process_smscb_cmd(trx->bts, *cb_cmd_type,
- TLVP_LEN(&tp, RSL_IE_SMSCB_MSG),
- TLVP_VAL(&tp, RSL_IE_SMSCB_MSG));
+ rc = bts_process_smscb_cmd(trx->bts, *cb_cmd_type, TLVP_LEN(&tp, RSL_IE_SMSCB_MSG),
+ TLVP_VAL(&tp, RSL_IE_SMSCB_MSG));
+ if (rc < 0)
+ return rsl_tx_error_report(trx, RSL_ERR_IE_CONTENT, &cch->chan_nr, NULL, msg);
+
+ return 0;
}
/*! Prefix a given SACCH frame with a L2/LAPDm UI header and store it in given output buffer.