[GPRS] SGSN: fix another segfault (and use-after-free) when GGSN is dead
diff --git a/openbsc/src/gprs/sgsn_libgtp.c b/openbsc/src/gprs/sgsn_libgtp.c
index 03de8cc..f42ea8c 100644
--- a/openbsc/src/gprs/sgsn_libgtp.c
+++ b/openbsc/src/gprs/sgsn_libgtp.c
@@ -233,6 +233,7 @@
{
struct sgsn_pdp_ctx *pctx = cbp;
uint8_t reject_cause;
+ int rc;
DEBUGP(DGPRS, "Received CREATE PDP CTX CONF, cause=%d(%s)\n",
cause, get_value_string(gtp_cause_strs, cause));
@@ -267,10 +268,10 @@
pctx->state = PDP_STATE_NONE;
if (pdp)
pdp_freepdp(pdp);
- sgsn_pdp_ctx_free(pctx);
/* Send PDP CTX ACT REJ to MS */
- return gsm48_tx_gsm_act_pdp_rej(pctx->mm, pdp->ti, reject_cause,
+ rc = gsm48_tx_gsm_act_pdp_rej(pctx->mm, pctx->ti, reject_cause,
0, NULL);
+ sgsn_pdp_ctx_free(pctx);
return EOF;
}