lapd: Fixed possible double free buf in lapd_core.c
Written-by: Andreas Eversberg <jolly@eversberg.eu>
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
diff --git a/src/gsm/lapd_core.c b/src/gsm/lapd_core.c
index dcc2150..54adbca 100644
--- a/src/gsm/lapd_core.c
+++ b/src/gsm/lapd_core.c
@@ -1920,10 +1920,11 @@
if (dl->send_buffer)
msgb_free(dl->send_buffer);
dl->send_out = 0;
- if (msg && msg->len) {
+ if (msg && msg->len)
/* Write data into the send buffer, to be sent first */
dl->send_buffer = msg;
- }
+ else
+ dl->send_buffer = NULL;
/* Discard partly received L3 message */
if (dl->rcv_buffer) {