diff options
| author | Harald Welte <laforge@gnumonks.org> | 2019-05-20 14:33:45 +0200 |
|---|---|---|
| committer | Harald Welte <laforge@gnumonks.org> | 2019-05-21 00:31:11 +0200 |
| commit | 89bfea63c9e4e3a308288fcb98e48bf88919e246 (patch) | |
| tree | 031d963792e327a67041618065938a62dbc991b0 /src/common/rsl.c | |
| parent | 5567d71d39d051cbf9aa4fe744a0d0b65bb56fdc (diff) | |
cbch: Fix memory leak and send error message on invalid SMSCB command
Change-Id: I411d1fb3693a2f7cf7bba3d38b1aaf276a4137ba
Related: OS#4011
Diffstat (limited to 'src/common/rsl.c')
| -rw-r--r-- | src/common/rsl.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/src/common/rsl.c b/src/common/rsl.c index 76aaef33..8021d2d4 100644 --- a/src/common/rsl.c +++ b/src/common/rsl.c @@ -487,6 +487,7 @@ static int rsl_rx_sms_bcast_cmd(struct gsm_bts_trx *trx, struct msgb *msg) struct abis_rsl_cchan_hdr *cch = msgb_l2(msg); struct tlv_parsed tp; struct rsl_ie_cb_cmd_type *cb_cmd_type; + int rc; rsl_tlv_parse(&tp, msgb_l3(msg), msgb_l3len(msg)); @@ -497,9 +498,12 @@ static int rsl_rx_sms_bcast_cmd(struct gsm_bts_trx *trx, struct msgb *msg) cb_cmd_type = (struct rsl_ie_cb_cmd_type *) TLVP_VAL(&tp, RSL_IE_CB_CMD_TYPE); - return bts_process_smscb_cmd(trx->bts, *cb_cmd_type, - TLVP_LEN(&tp, RSL_IE_SMSCB_MSG), - TLVP_VAL(&tp, RSL_IE_SMSCB_MSG)); + rc = bts_process_smscb_cmd(trx->bts, *cb_cmd_type, TLVP_LEN(&tp, RSL_IE_SMSCB_MSG), + TLVP_VAL(&tp, RSL_IE_SMSCB_MSG)); + if (rc < 0) + return rsl_tx_error_report(trx, RSL_ERR_IE_CONTENT, &cch->chan_nr, NULL, msg); + + return 0; } /*! Prefix a given SACCH frame with a L2/LAPDm UI header and store it in given output buffer. |