commit 4dd477f16c822628344a575ebdce1a81752c1727
author Vadim Yanitskiy <axilirator@gmail.com> Sat May 11 03:00:30 2019 +0700
committer Harald Welte <laforge@gnumonks.org> Mon May 13 20:15:04 2019 +0000
tree 690277afc92f681e4d99bac8b90458d60db0b6c6
parent a870faf6744cdac7dad0df5ff75d7e534df1a1ac

libmsc/msc_a.c: fix possible NULL-pointer dereferences

Change-Id: Id5c95fbf318a2e51e7ffee2e08ceab3042b26cc9
Fixes: CID#198411, CID#198414

src/libmsc/msc_a.c

diff --git a/src/libmsc/msc_a.c b/src/libmsc/msc_a.c
index 5137e20..cfba545 100644
--- a/src/libmsc/msc_a.c
+++ b/src/libmsc/msc_a.c
@@ -245,10 +245,18 @@
 int msc_a_vlr_set_cipher_mode(void *_msc_a, bool umts_aka, bool retrieve_imeisv)
 {
 	struct msc_a *msc_a = _msc_a;
-	struct vlr_subscr *vsub = msc_a_vsub(msc_a);
+	struct vlr_subscr *vsub;
 
-	if (!msc_a || !vsub || !vsub->last_tuple) {
-		LOG_MSC_A(msc_a, LOGL_ERROR, "Insufficient info to start ciphering\n");
+	if (!msc_a) {
+		LOGP(DMSC, LOGL_ERROR, "Insufficient info to start ciphering: "
+				       "MSC-A role is NULL?!?\n");
+		return -EINVAL;
+	}
+
+	vsub = msc_a_vsub(msc_a);
+	if (!vsub || !vsub->last_tuple) {
+		LOG_MSC_A(msc_a, LOGL_ERROR, "Insufficient info to start ciphering: "
+					     "vlr_subscr is NULL?!?\n");
 		return -EINVAL;
 	}
 
@@ -280,12 +288,22 @@
 
 static int msc_a_ran_enc_ciphering(struct msc_a *msc_a, bool umts_aka, bool retrieve_imeisv)
 {
-	struct gsm_network *net = msc_a_net(msc_a);
-	struct vlr_subscr *vsub = msc_a_vsub(msc_a);
+	struct gsm_network *net;
+	struct vlr_subscr *vsub;
 	struct ran_msg msg;
 
-	if (!msc_a || !vsub || !vsub->last_tuple) {
-		LOG_MSC_A(msc_a, LOGL_ERROR, "Insufficient info to start ciphering\n");
+	if (!msc_a) {
+		LOGP(DMSC, LOGL_ERROR, "Insufficient info to start ciphering: "
+				       "MSC-A role is NULL?!?\n");
+		return -EINVAL;
+	}
+
+	net = msc_a_net(msc_a);
+	vsub = msc_a_vsub(msc_a);
+
+	if (!net || !vsub || !vsub->last_tuple) {
+		LOG_MSC_A(msc_a, LOGL_ERROR, "Insufficient info to start ciphering: "
+					     "gsm_network and/or vlr_subscr is NULL?!?\n");
 		return -EINVAL;
 	}