mncc: Fix a crash in the call release code
When the remote subscriber has not responded yet we could
end up with a crash in the MNCC code. It was enough to dial
the number, then hang up and bsc_hack would end up with a
segfault due the list poisining of linux_list.
diff --git a/openbsc/src/mncc_builtin.c b/openbsc/src/mncc_builtin.c
index 640a286..0226b27 100644
--- a/openbsc/src/mncc_builtin.c
+++ b/openbsc/src/mncc_builtin.c
@@ -238,12 +238,18 @@
free_call(call);
return 0;
}
+
rel->callref = remote->callref;
DEBUGP(DMNCC, "(call %x) Releasing remote with cause %d\n",
call->callref, rel->cause.value);
- mncc_tx_to_cc(remote->net, MNCC_REL_REQ, rel);
+ /*
+ * Release this side of the call right now. Otherwise we end up
+ * in this method for the other call and will also try to release
+ * it and then we will end up with a double free and a crash
+ */
free_call(call);
+ mncc_tx_to_cc(remote->net, MNCC_REL_REQ, rel);
return 0;
}