mirror of
https://github.com/open5gs/open5gs.git
synced 2026-04-28 03:19:31 +00:00
7d0026e24e
Bug: A double-free scenario in the error handling path: When ogs_sbi_send_request_with_sepp_discovery failed, it called ogs_sbi_xact_remove(xact) internally. The function then returned false to its caller. The caller (smf_sbi_discover_and_send) also called ogs_sbi_xact_remove(xact) on failure. This caused the discovery_option structure to be freed twice, leading to the valgrind error: ``` ==90== Invalid read of size 8 ==90== at 0x49AFBB6: ogs_sbi_discovery_option_free (message.c:3633) ==90== by 0x49CC100: ogs_sbi_xact_remove (context.c:2674) ==90== by 0x407DDDC: smf_sbi_discover_and_send (sbi-path.c:392) ``` Fix: Now the function follows proper resource ownership semantics: the caller who creates the transaction is responsible for cleanup when the function fails, making the error handling consistent and preventing double-free issues. Added missing cleanup to ogs_sbi_send_request_to_nf_instance and af_sbi_discover_and_send. |
||
|---|---|---|
| .. | ||
| af-sm.c | ||
| af-sm.h | ||
| context.c | ||
| context.h | ||
| event.c | ||
| event.h | ||
| init.c | ||
| init.h | ||
| local.c | ||
| local.h | ||
| meson.build | ||
| nbsf-build.c | ||
| nbsf-build.h | ||
| nbsf-handler.c | ||
| nbsf-handler.h | ||
| nnrf-handler.c | ||
| nnrf-handler.h | ||
| npcf-build.c | ||
| npcf-build.h | ||
| npcf-handler.c | ||
| npcf-handler.h | ||
| sbi-path.c | ||
| sbi-path.h | ||