diff options
| author | Daniel Willmann <dwillmann@sysmocom.de> | 2023-03-02 16:51:59 +0100 |
|---|---|---|
| committer | Daniel Willmann <dwillmann@sysmocom.de> | 2023-05-31 12:11:15 +0200 |
| commit | 6aa4b6961c0f851d0406690d04991c34fe643cb4 (patch) | |
| tree | 437828f39627089c2b1ecd59555667453572a935 /examples | |
| parent | 68dc5218cadd64fdffb0d8ba1d99bd574a97e68c (diff) | |
ipa-stream-server: Return -EBADF in read_cb after osmo_stream_srv_destroy()
This fixes a potential heap-use-after-free error.
When there is still data to be written the osmo_stream_srv_cb() will
call osmo_stream_srv_write() which will try to dereference conn even
though it has already been freed.
Change-Id: I5ac1920b8d4ce3b0205f00d253e7ed878fb745e3
Diffstat (limited to 'examples')
| -rw-r--r-- | examples/ipa-stream-server.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/examples/ipa-stream-server.c b/examples/ipa-stream-server.c index c311697..1ca1aaf 100644 --- a/examples/ipa-stream-server.c +++ b/examples/ipa-stream-server.c @@ -1,4 +1,5 @@ /* IPA stream srv example */ +#include <errno.h> #include <stdio.h> #include <stdlib.h> #include <string.h> @@ -61,7 +62,7 @@ int read_cb(struct osmo_stream_srv *conn) LOGP(DSTREAMTEST, LOGL_ERROR, "cannot receive message\n"); osmo_stream_srv_destroy(conn); msgb_free(msg); - return 0; + return -EBADF; } if (osmo_ipa_process_msg(msg) < 0) { LOGP(DSTREAMTEST, LOGL_ERROR, "Bad IPA message\n"); |