gsm_subscriber_base: Take a ref on the subscriber to avoid use after free
On expired paging we might access a GSM Subscriber that has already
been deleted. To avoid this we will add a subscr_get/subscr_put for
the subscriber to the allocation and release path of the request.
Reported-by: Richard Zahoransky
diff --git a/openbsc/src/gsm_subscriber_base.c b/openbsc/src/gsm_subscriber_base.c
index 50e6865..c06b1ce 100644
--- a/openbsc/src/gsm_subscriber_base.c
+++ b/openbsc/src/gsm_subscriber_base.c
@@ -1,7 +1,8 @@
/* The concept of a subscriber as seen by the BSC */
/* (C) 2008 by Harald Welte <laforge@gnumonks.org>
- * (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009-2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2010 by On Waves
*
* All Rights Reserved
*
@@ -88,6 +89,7 @@
request->cbfn(hooknum, event, msg, data, request->param);
subscr->in_callback = 0;
+ subscr_put(subscr);
talloc_free(request);
return 0;
}
@@ -165,7 +167,7 @@
}
memset(request, 0, sizeof(*request));
- request->subscr = subscr;
+ request->subscr = subscr_get(subscr);
request->channel_type = type;
request->cbfn = cbfn;
request->param = param;