pdch: Fix heap-use-after-free in pdch->ulc
In existing previous code, pdch->ulc would be freed in
gprs_rlcmac_pdch::free_resources() when it became disabled as per PCUIF
info_ind (for instance, when a DYN TS is switched PDCH->SDCCH8).
However, pdch->ulc was so far only allocated during pdch_init, which is
only called during bts_alloc() time.
Hence, after first info_ind disabling it, if it became again enabled
(again by info_ind re-enabling it after SDCCH8 was not longer in use),
the pdch->ulc would be used again but it would point to freed memory.
Let's rearrange how/when resources are freed to make it more logical.
With this patch, pdch internal resources are freed upon ->disable(), and
re-allocated upon ->enable().
Change-Id: Id51f5f6a54ac9f24b784c17bc360ac38f5726fc7
diff --git a/tests/tbf/TbfTest.cpp b/tests/tbf/TbfTest.cpp
index 2c2c7ae..5065e90 100644
--- a/tests/tbf/TbfTest.cpp
+++ b/tests/tbf/TbfTest.cpp
@@ -2282,7 +2282,7 @@
the_pcu->alloc_algorithm = alloc_algorithm_b;
bts->trx[0].pdch[2].enable();
bts->trx[0].pdch[3].enable();
- bts->trx[0].pdch[4].enable();
+ /* bts->trx[0].pdch[4].enable(); Already enabled during setup_bts() */
bts->trx[0].pdch[5].enable();
gprs_bssgp_init(bts, 4234, 4234, 1, 1, false, 0, 0, 0);
@@ -2327,7 +2327,7 @@
the_pcu->alloc_algorithm = alloc_algorithm_b;
bts->trx[0].pdch[2].enable();
bts->trx[0].pdch[3].enable();
- bts->trx[0].pdch[4].enable();
+ /* bts->trx[0].pdch[4].enable(); Already enabled during setup_bts()) */
bts->trx[0].pdch[5].enable();
gprs_bssgp_init(bts, 5234, 5234, 1, 1, false, 0, 0, 0);