daniel has uploaded this change for review. (
https://gerrit.osmocom.org/c/libosmo-netif/+/33104 )
Change subject: ipa-stream-server: Return -EBADF in read_cb after
osmo_stream_srv_destroy()
......................................................................
ipa-stream-server: Return -EBADF in read_cb after osmo_stream_srv_destroy()
This fixes a potential heap-use-after-free error.
When there is still data to be written the osmo_stream_srv_cb() will
call osmo_stream_srv_write() which will try to dereference conn even
though it has already been freed.
Change-Id: I5ac1920b8d4ce3b0205f00d253e7ed878fb745e3
---
M examples/ipa-stream-server.c
1 file changed, 15 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-netif refs/changes/04/33104/1
diff --git a/examples/ipa-stream-server.c b/examples/ipa-stream-server.c
index c311697..e01a3cb 100644
--- a/examples/ipa-stream-server.c
+++ b/examples/ipa-stream-server.c
@@ -61,7 +61,7 @@
LOGP(DSTREAMTEST, LOGL_ERROR, "cannot receive message\n");
osmo_stream_srv_destroy(conn);
msgb_free(msg);
- return 0;
+ return -EBADF;
}
if (osmo_ipa_process_msg(msg) < 0) {
LOGP(DSTREAMTEST, LOGL_ERROR, "Bad IPA message\n");
--
To view, visit https://gerrit.osmocom.org/c/libosmo-netif/+/33104
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings
Gerrit-Project: libosmo-netif
Gerrit-Branch: master
Gerrit-Change-Id: I5ac1920b8d4ce3b0205f00d253e7ed878fb745e3
Gerrit-Change-Number: 33104
Gerrit-PatchSet: 1
Gerrit-Owner: daniel <dwillm...@sysmocom.de>
Gerrit-MessageType: newchange
