diff options
| author | Harald Welte <laforge@osmocom.org> | 2020-12-21 17:43:54 +0100 |
|---|---|---|
| committer | Harald Welte <laforge@osmocom.org> | 2020-12-21 17:43:54 +0100 |
| commit | d2a61179a34282924e86ccaecdb95e3a3711d1ff (patch) | |
| tree | d1fda315b89bdd942f23435faba673366ed655b5 /src/gb/gprs_ns2_sns.c | |
| parent | c296e2921a616258fbf38018e14fd563084f0fbf (diff) | |
lapd_core: Don't dereference data link after sending PRIM_DL_REL
We must always send the RELEASE.{indication,confirm} last before
returning from a function. We cannot rely on the datalink to
still be around after the call, as the SAP user might have destroyed
the data link meanwhile.
This fixes a heap use-after-free (at least) with RBS2000 when the BTS
is fully brought up and the OML data link is lost, see OS#1762
Change-Id: I8ccca8d5e5d07b666557afe12ab8ac4910ddfb00
Related: OS#1761
Related: OS#1762
Diffstat (limited to 'src/gb/gprs_ns2_sns.c')
0 files changed, 0 insertions, 0 deletions