[libss7-commits] mattf: trunk r86 - in /trunk: isup.c ss7linktest.c

[SVN commits to the libss7 project]

Author: mattf
Date: Sat Jun 16 19:08:51 2007
New Revision: 86

URL: http://svn.digium.com/view/libss7?view=rev&rev=86
Log:
Fix some scenarios where a call could potentially be written to while free'd already

Modified:
    trunk/isup.c
    trunk/ss7linktest.c

Modified: trunk/isup.c
URL: http://svn.digium.com/view/libss7/trunk/isup.c?view=diff&rev=86&r1=85&r2=86
==============================================================================
--- trunk/isup.c (original)
+++ trunk/isup.c Sat Jun 16 19:08:51 2007
@@ -694,21 +694,31 @@
 	return "Unknown";
 }
 
-struct isup_call * isup_new_call(struct ss7 *ss7)
+static struct isup_call * __isup_new_call(struct ss7 *ss7, int nolink)
 {
 	struct isup_call *c, *cur;
 	c = calloc(1, sizeof(struct isup_call));
 	if (!c)
 		return NULL;
-	cur = ss7->calls;
-	if (cur) {
-		while (cur->next)
-			cur = cur->next;
-		cur->next = c;
-	} else
-		ss7->calls = c;
-
-	return c;
+
+	if (nolink)
+		return c;
+	else {
+		cur = ss7->calls;
+		if (cur) {
+			while (cur->next)
+				cur = cur->next;
+			cur->next = c;
+		} else
+			ss7->calls = c;
+
+		return c;
+	}
+}
+
+struct isup_call * isup_new_call(struct ss7 *ss7)
+{
+	return __isup_new_call(ss7, 0);
 }
 
 void isup_set_call_dpc(struct isup_call *c, unsigned int dpc)
@@ -746,7 +756,7 @@
 	}
 
 	if (!winner) {
-		winner = isup_new_call(ss7);
+		winner = __isup_new_call(ss7, 0);
 		winner->cic = cic;
 	}
 
@@ -767,13 +777,14 @@
 		cur = cur->next;
 	}
 
-	if (!prev)
-		ss7->calls = winner->next;
-	else
-		prev->next = winner->next;
-
-	if (winner)
-		free(winner);
+	if (winner) {
+		if (!prev)
+			ss7->calls = winner->next;
+		else
+			prev->next = winner->next;
+	}
+
+	free(c);
 
 	return;
 }
@@ -1145,8 +1156,6 @@
 		return -1;
 	}
 
-	c = isup_find_call(ss7, cic);
-
 	/* Check for the ANSI IAM exception */
 	if (messages[ourmessage].messagetype == ISUP_IAM) {
 		if (ss7->switchtype == SS7_ITU) {
@@ -1165,6 +1174,28 @@
 		parms = messages[ourmessage].param_list;
 	}
 
+	/* Make sure we don't hijack a call associated isup_call for non call
+	 * associated messages */
+	switch (mh->type) {
+		case ISUP_BLO:
+		case ISUP_BLA:
+		case ISUP_UBL:
+		case ISUP_UBA:
+		case ISUP_CGB:
+		case ISUP_CGBA:
+		case ISUP_CGUA:
+		case ISUP_CGU:
+			c = __isup_new_call(ss7, 1);
+			break;
+		default:
+			c = isup_find_call(ss7, cic);
+	}
+
+	if (!c) {
+		ss7_error(ss7, "Huh? No call!!!???\n");
+		return -1;
+	}
+
 	/* Parse fixed parms */
 	for (x = 0; x < fixedparams; x++) {
 		res = do_parm(ss7, c, mh->type, parms[x], (void *)(mh->data + offset), len, PARM_TYPE_FIXED, 0);

Modified: trunk/ss7linktest.c
URL: http://svn.digium.com/view/libss7/trunk/ss7linktest.c?view=diff&rev=86&r1=85&r2=86
==============================================================================
--- trunk/ss7linktest.c (original)
+++ trunk/ss7linktest.c Sat Jun 16 19:08:51 2007
@@ -164,6 +164,7 @@
 					case ISUP_EVENT_REL:
 						printf("Got REL for cic %d\n", e->rel.cic);
 						isup_rlc(ss7, e->rel.call);
+						ss7_call(ss7);
 						break;
 					case ISUP_EVENT_ACM:
 						printf("Got ACM for cic %d\n", e->acm.cic);
@@ -174,7 +175,7 @@
 						break;
 					case ISUP_EVENT_RLC:
 						printf("Got RLC for cic %d\n", e->rlc.cic);
-						//ss7_call(ss7);
+						ss7_call(ss7);
 						break;
 					default:
 						printf("Unknown event %d\n", e->e);