tbf: Make finding use-after-free more easy and set to NULL or return
Make finding use-after-free more easy by setting things to NULL
or simply return after tbf_free(this) has been called.
diff --git a/src/bts.cpp b/src/bts.cpp
index 7c60452..ff16e29 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -851,6 +851,7 @@
"Killing pending DL TBF\n", tlli,
tbf_name(dl_tbf));
tbf_free(dl_tbf);
+ dl_tbf = NULL;
}
LOGP(DRLCMAC, LOGL_DEBUG, "MS requests UL TBF "
"in packet resource request of single "
diff --git a/src/tbf.cpp b/src/tbf.cpp
index cac807c..1568720 100644
--- a/src/tbf.cpp
+++ b/src/tbf.cpp
@@ -568,6 +568,7 @@
LOGP(DRLCMAC, LOGL_NOTICE, "%s releasing due to "
"PACCH assignment timeout.\n", tbf_name(this));
tbf_free(this);
+ return;
} else
LOGP(DRLCMAC, LOGL_ERROR, "Error: %s is not "
"in assign state\n", tbf_name(this));
@@ -595,6 +596,7 @@
"%s will be freed due to timeout\n", tbf_name(this));
/* free TBF */
tbf_free(this);
+ return;
break;
default:
LOGP(DRLCMAC, LOGL_ERROR,
@@ -1531,6 +1533,7 @@
"Killing pending DL TBF\n", tlli(),
tbf_name(dl_tbf));
tbf_free(dl_tbf);
+ dl_tbf = NULL;
}
/* tbf_by_tlli will not find your TLLI, because it is not
* yet marked valid */
@@ -1540,6 +1543,7 @@
"Killing pending UL TBF\n", tlli(),
tbf_name(ul_tbf));
tbf_free(ul_tbf);
+ ul_tbf = NULL;
}
/* mark TLLI valid now */
tlli_mark_valid();