diff options
| author | Holger Hans Peter Freyther <zecke@selfish.org> | 2010-12-27 23:25:53 +0100 |
|---|---|---|
| committer | Holger Hans Peter Freyther <zecke@selfish.org> | 2011-01-06 14:52:51 +0100 |
| commit | 79eff7eeff19f5774299a5e8bfb294b1969ed7d5 (patch) | |
| tree | 5930e7557c8713837c5d1b5d3702ca2190129654 /openbsc/src/gsm_04_11.c | |
| parent | 583e9aef33e93c7a6146116b814fdd1e8b367466 (diff) | |
sms: Fix crash by saving the gsm_network
The conn might be released during the loop and then conn->bts
is a null pointer and we end up crashing. Store the gsm_network
in a local variable and access this one.
Diffstat (limited to 'openbsc/src/gsm_04_11.c')
| -rw-r--r-- | openbsc/src/gsm_04_11.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/openbsc/src/gsm_04_11.c b/openbsc/src/gsm_04_11.c index bb43196b7..db445ae00 100644 --- a/openbsc/src/gsm_04_11.c +++ b/openbsc/src/gsm_04_11.c @@ -1187,10 +1187,13 @@ void _gsm411_sms_trans_free(struct gsm_trans *trans) void gsm411_sapi_n_reject(struct gsm_subscriber_connection *conn) { struct gsm_subscriber *subscr; + struct gsm_network *net; struct gsm_trans *trans, *tmp; subscr = subscr_get(conn->subscr); - llist_for_each_entry_safe(trans, tmp, &conn->bts->network->trans_list, entry) + net = conn->bts->network; + + llist_for_each_entry_safe(trans, tmp, &net->trans_list, entry) if (trans->conn == conn) { struct gsm_sms *sms = trans->sms.sms; if (!sms) { |