umts_rlc, umts_mac: fix memory leaks (found via ASAN)

Such leaks are triggered by malformed packets

Change-Id: Ie392834b235cf9c5a249ede7fffb5a0dbdb360e5
Reviewed-on: https://code.wireshark.org/review/27556
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

1 files changed, 2 insertions, 3 deletions

diff --git a/epan/dissectors/packet-umts_rlc.c b/epan/dissectors/packet-umts_rlc.c
index fec5c31445..a89c524379 100644
--- a/epan/dissectors/packet-umts_rlc.c
+++ b/epan/dissectors/packet-umts_rlc.c
@@ -470,8 +470,7 @@ rlc_frag_assign_data(struct rlc_frag *frag, tvbuff_t *tvb,
              guint16 offset, guint16 length)
 {
     frag->len  = length;
-    frag->data = (guint8 *)g_malloc(length);
-    tvb_memcpy(tvb, frag->data, offset, length);
+    frag->data = (guint8 *)tvb_memdup(wmem_file_scope(), tvb, offset, length);
     return 0;
 }
 
@@ -848,7 +847,7 @@ reassemble_data(struct rlc_channel *ch, struct rlc_sdu *sdu, struct rlc_frag *fr
     temp = sdu->frags;
     while (temp && ((offs + temp->len) <= sdu->len)) {
         memcpy(sdu->data + offs, temp->data, temp->len);
-        g_free(temp->data);
+        wmem_free(wmem_file_scope(), temp->data);
         temp->data = NULL;
         /* mark this fragment in reassembled table */
         g_hash_table_insert(reassembled_table, temp, sdu);