| commit | a35c296b6be95f240fe9c4207e5eec8d7886ca61 | [log] [tgz] |
|---|---|---|
| author | Alexander Couzens <lynxis@fe80.eu> | Mon Apr 19 03:30:15 2021 +0200 |
| committer | laforge <laforge@osmocom.org> | Sun May 23 10:32:40 2021 +0000 |
| tree | fcf7a4bea9f8e9ae5bd70c6031538b009251fd67 | |
| parent | fef61cd2ddf2576a8284f631e17d8397bf6f4d84 [diff] [blame] |
gprs_ns2: sns: fix del bind() When the bind to be removed is not the last entry, it would remove the wrong SNS bind resulting in use-after-free memory. Change-Id: I79062d404ebba9d5c8f7f209bebde146fa08c71f
diff --git a/src/gb/gprs_ns2_sns.c b/src/gb/gprs_ns2_sns.c index c6e80af..296a2e7 100644 --- a/src/gb/gprs_ns2_sns.c +++ b/src/gb/gprs_ns2_sns.c
@@ -1995,6 +1995,7 @@ if (tmp->bind == bind) { llist_del(&tmp->list); found = true; + break; } }