aboutsummaryrefslogtreecommitdiffstats
path: root/src/nmt
diff options
context:
space:
mode:
authorAndreas Eversberg <jolly@eversberg.eu>2017-07-02 10:44:47 +0200
committerAndreas Eversberg <jolly@eversberg.eu>2017-07-15 07:38:13 +0200
commit3774519631203e4c3b05ad6c32ce1e8aaca54d2e (patch)
tree97d52e8f7860358c8da9ec99ad617e274ae29158 /src/nmt
parent7af886c6005b6c3ea4459c6110bbb7984e688b1e (diff)
NMT: Fixed "use after free" bug
Diffstat (limited to 'src/nmt')
-rw-r--r--src/nmt/nmt.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/src/nmt/nmt.c b/src/nmt/nmt.c
index 1ab0af0..1739886 100644
--- a/src/nmt/nmt.c
+++ b/src/nmt/nmt.c
@@ -706,10 +706,11 @@ static void tx_roaming_ident(nmt_t *nmt, frame_t *frame)
{
if (++nmt->tx_frame_count == 1)
PDEBUG_CHAN(DNMT, DEBUG_INFO, "Sending identity request.\n");
+ tx_ident(nmt, frame);
if (nmt->tx_frame_count == 8) {
+ PDEBUG_CHAN(DNMT, DEBUG_NOTICE, "Timeout waiting for identity reply\n");
nmt_release(nmt);
}
- tx_ident(nmt, frame);
}
static void rx_roaming_ident(nmt_t *nmt, frame_t *frame)
@@ -763,10 +764,11 @@ static void tx_mo_ident(nmt_t *nmt, frame_t *frame)
{
if (++nmt->tx_frame_count == 1)
PDEBUG_CHAN(DNMT, DEBUG_INFO, "Sending identity request.\n");
+ tx_ident(nmt, frame);
if (nmt->tx_frame_count == 8) {
+ PDEBUG_CHAN(DNMT, DEBUG_NOTICE, "Timeout waiting for identity reply\n");
nmt_release(nmt);
}
- tx_ident(nmt, frame);
}
static void rx_mo_ident(nmt_t *nmt, frame_t *frame)
@@ -1023,12 +1025,13 @@ static void tx_mt_ident(nmt_t *nmt, frame_t *frame)
if (++nmt->tx_frame_count == 1)
PDEBUG_CHAN(DNMT, DEBUG_INFO, "Sending identity request.\n");
+ tx_ident(nmt, frame);
if (nmt->tx_frame_count == 8) {
+ PDEBUG_CHAN(DNMT, DEBUG_NOTICE, "Timeout waiting for identity reply\n");
PDEBUG_CHAN(DNMT, DEBUG_INFO, "Release call towards network.\n");
call_in_release(trans->callref, CAUSE_TEMPFAIL);
destroy_transaction(trans);
}
- tx_ident(nmt, frame);
}
static void rx_mt_ident(nmt_t *nmt, frame_t *frame)