bsc_msc_ip.c: Return after having freed the msgb

When reading MGCP is failing (e.g. because the udp socket
is not connected yet) we would have freed the msgb but we
didn't return and then executed msgb_put on a dead buffer.

1 files changed, 7 insertions, 2 deletions

diff --git a/openbsc/src/bsc_msc_ip.c b/openbsc/src/bsc_msc_ip.c
index 166726342..535445a4a 100644
--- a/openbsc/src/bsc_msc_ip.c
+++ b/openbsc/src/bsc_msc_ip.c
@@ -603,9 +603,14 @@ static int mgcp_do_read(struct bsc_fd *fd)
 
 	ret = read(fd->fd, mgcp->data, mgcp->len);
 	if (ret <= 0) {
-		LOGP(DMGCP, LOGL_ERROR, "Failed to read: %d\n", errno);
+		LOGP(DMGCP, LOGL_ERROR, "Failed to read: %d/%s\n", errno, strerror(errno));
 		msgb_free(mgcp);
-	}
+		return -1;
+	} else if (ret > 4096 - 128) {
+		LOGP(DMGCP, LOGL_ERROR, "Too much data: %d\n", ret);
+		msgb_free(mgcp);
+		return -1; 
+        }
 
 	msgb_put(mgcp, ret);
 	msc_queue_write(mgcp, NAT_IPAC_PROTO_MGCP);