summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndreas Eversberg <jolly@eversberg.eu>2011-11-01 09:40:21 +0100
committerHarald Welte <laforge@gnumonks.org>2011-11-12 23:23:36 +0100
commit5ad4ac800cf26b8cd2f49c1580678a8df4b55f50 (patch)
treefe639f4a58bcc5ec50b3120f83a8e9ecf630afcd
parentf948dbc442c44c402d6559bdd746f5ef8d01fff2 (diff)
lapd: Fixed possible double free buf in lapd_core.c
Written-by: Andreas Eversberg <jolly@eversberg.eu> Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
-rw-r--r--src/gsm/lapd_core.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/src/gsm/lapd_core.c b/src/gsm/lapd_core.c
index dcc2150..54adbca 100644
--- a/src/gsm/lapd_core.c
+++ b/src/gsm/lapd_core.c
@@ -1920,10 +1920,11 @@ static int lapd_res_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
if (dl->send_buffer)
msgb_free(dl->send_buffer);
dl->send_out = 0;
- if (msg && msg->len) {
+ if (msg && msg->len)
/* Write data into the send buffer, to be sent first */
dl->send_buffer = msg;
- }
+ else
+ dl->send_buffer = NULL;
/* Discard partly received L3 message */
if (dl->rcv_buffer) {