diff options
author | Harald Welte <laforge@osmocom.org> | 2020-06-08 20:46:53 +0200 |
---|---|---|
committer | Harald Welte <laforge@osmocom.org> | 2020-06-08 20:46:53 +0200 |
commit | 627e285fd0dc82aeb15f0c35c946190da40e6f8c (patch) | |
tree | 6854f8183cdeca74dc2d8a5b89ec1c94a91f1d6b | |
parent | 5e0b829884d2cd939b14b8fa6d88d9242094b06f (diff) |
Fix memory leak when SNDCP de-fragmentation is used
As msgb ownership is not passed along, we need to free the message
buffer memory we allocate in defrag_segments() after calling
sgsn_rx_sndcp_ud_ind().
Change-Id: I1185b1aa99bb167d616eb469e5445e4ed5ad949d
Closes: OS#4603
-rw-r--r-- | src/sgsn/gprs_sndcp.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/sgsn/gprs_sndcp.c b/src/sgsn/gprs_sndcp.c index 01be57ef2..7ce69600d 100644 --- a/src/sgsn/gprs_sndcp.c +++ b/src/sgsn/gprs_sndcp.c @@ -366,6 +366,10 @@ static int defrag_segments(struct gprs_sndcp_entity *sne) rc = sgsn_rx_sndcp_ud_ind(&sne->ra_id, sne->lle->llme->tlli, sne->nsapi, msg, npdu_len, expnd); + /* we must free the memory we allocated above; ownership is not transferred + * downwards in the call above */ + msgb_free(msg); + if (any_pcomp_or_dcomp_active(sgsn)) talloc_free(expnd); |