sms: Fix crash by saving the gsm_network
The conn might be released during the loop and then conn->bts
is a null pointer and we end up crashing. Store the gsm_network
in a local variable and access this one.
diff --git a/openbsc/src/gsm_04_11.c b/openbsc/src/gsm_04_11.c
index bb43196..db445ae 100644
--- a/openbsc/src/gsm_04_11.c
+++ b/openbsc/src/gsm_04_11.c
@@ -1187,10 +1187,13 @@
void gsm411_sapi_n_reject(struct gsm_subscriber_connection *conn)
{
struct gsm_subscriber *subscr;
+ struct gsm_network *net;
struct gsm_trans *trans, *tmp;
subscr = subscr_get(conn->subscr);
- llist_for_each_entry_safe(trans, tmp, &conn->bts->network->trans_list, entry)
+ net = conn->bts->network;
+
+ llist_for_each_entry_safe(trans, tmp, &net->trans_list, entry)
if (trans->conn == conn) {
struct gsm_sms *sms = trans->sms.sms;
if (!sms) {