|
 |
27639a |
Fri Jun 4 10:54:04 2010 Jan Just Keijser <jan.just.keijser@gmail.com>
|
|
|
27639a |
|
|
|
27639a |
* pptp_ctrl.c: check for failure return by pptp_send_ctrl_packet
|
|
|
27639a |
and avoid using freed struct conn.
|
|
|
27639a |
|
|
|
27639a |
--- pptp_ctrl.c 2010-06-15 15:05:46.743913798 +0100
|
|
|
27639a |
+++ pptp_ctrl.c 2010-06-15 14:32:00.480100647 +0100
|
|
|
27639a |
@@ -396,9 +400,10 @@
|
|
|
27639a |
/* don't check state against WAIT_DISCONNECT... allow multiple disconnect
|
|
|
27639a |
* requests to be made.
|
|
|
27639a |
*/
|
|
|
27639a |
- pptp_send_ctrl_packet(conn, &rqst, sizeof(rqst));
|
|
|
27639a |
- pptp_reset_timer();
|
|
|
27639a |
- call->state.pns = PNS_WAIT_DISCONNECT;
|
|
|
27639a |
+ if (pptp_send_ctrl_packet(conn, &rqst, sizeof(rqst))) {
|
|
|
27639a |
+ pptp_reset_timer();
|
|
|
27639a |
+ call->state.pns = PNS_WAIT_DISCONNECT;
|
|
|
27639a |
+ }
|
|
|
27639a |
/* call structure will be freed when we have confirmation of disconnect. */
|
|
|
27639a |
}
|
|
|
27639a |
|
|
|
27639a |
@@ -431,9 +436,10 @@
|
|
|
27639a |
pptp_call_close(conn, vector_get_Nth(conn->call, i));
|
|
|
27639a |
/* now close connection */
|
|
|
27639a |
log("Closing PPTP connection");
|
|
|
27639a |
- pptp_send_ctrl_packet(conn, &rqst, sizeof(rqst));
|
|
|
27639a |
- pptp_reset_timer(); /* wait 60 seconds for reply */
|
|
|
27639a |
- conn->conn_state = CONN_WAIT_STOP_REPLY;
|
|
|
27639a |
+ if (pptp_send_ctrl_packet(conn, &rqst, sizeof(rqst))) {
|
|
|
27639a |
+ pptp_reset_timer(); /* wait 60 seconds for reply */
|
|
|
27639a |
+ conn->conn_state = CONN_WAIT_STOP_REPLY;
|
|
|
27639a |
+ }
|
|
|
27639a |
return;
|
|
|
27639a |
}
|
|
|
27639a |
|
|
|
27639a |
@@ -733,8 +739,8 @@
|
|
|
27639a |
reply.version = packet->version;
|
|
|
27639a |
/* protocol version not supported */
|
|
|
27639a |
reply.result_code = hton8(5);
|
|
|
27639a |
- pptp_send_ctrl_packet(conn, &reply, sizeof(reply));
|
|
|
27639a |
- pptp_reset_timer(); /* give sender a chance for a retry */
|
|
|
27639a |
+ if (pptp_send_ctrl_packet(conn, &reply, sizeof(reply)))
|
|
|
27639a |
+ pptp_reset_timer(); /* give sender a chance for a retry */
|
|
|
27639a |
} else { /* same or greater version */
|
|
|
27639a |
if (pptp_send_ctrl_packet(conn, &reply, sizeof(reply))) {
|
|
|
27639a |
conn->conn_state = CONN_ESTABLISHED;
|
|
|
27639a |
@@ -841,8 +847,8 @@
|
|
|
27639a |
hton8(1), hton8(PPTP_GENERAL_ERROR_NONE), 0
|
|
|
27639a |
};
|
|
|
27639a |
logecho( PPTP_ECHO_RQST);
|
|
|
27639a |
- pptp_send_ctrl_packet(conn, &reply, sizeof(reply));
|
|
|
27639a |
- pptp_reset_timer();
|
|
|
27639a |
+ if (pptp_send_ctrl_packet(conn, &reply, sizeof(reply)))
|
|
|
27639a |
+ pptp_reset_timer();
|
|
|
27639a |
break;
|
|
|
27639a |
}
|
|
|
27639a |
/* ----------- OUTGOING CALL MESSAGES ------------ */
|
|
|
27639a |
@@ -928,9 +935,10 @@
|
|
|
27639a |
vector_search(conn->call, ntoh16(packet->call_id), &call);
|
|
|
27639a |
if (call->callback != NULL)
|
|
|
27639a |
call->callback(conn, call, CALL_CLOSE_RQST);
|
|
|
27639a |
- pptp_send_ctrl_packet(conn, &reply, sizeof(reply));
|
|
|
27639a |
- pptp_call_destroy(conn, call);
|
|
|
27639a |
- log("Call closed (RQST) (call id %d)", (int) call->call_id);
|
|
|
27639a |
+ if (pptp_send_ctrl_packet(conn, &reply, sizeof(reply))) {
|
|
|
27639a |
+ pptp_call_destroy(conn, call);
|
|
|
27639a |
+ log("Call closed (RQST) (call id %d)", (int) call->call_id);
|
|
|
27639a |
+ }
|
|
|
27639a |
}
|
|
|
27639a |
break;
|
|
|
27639a |
}
|
|
|
27639a |
@@ -1067,8 +1075,9 @@
|
|
|
27639a |
} else { /* ka_state == NONE */ /* send keep-alive */
|
|
|
27639a |
struct pptp_echo_rqst rqst = {
|
|
|
27639a |
PPTP_HEADER_CTRL(PPTP_ECHO_RQST), hton32(global.conn->ka_id) };
|
|
|
27639a |
- pptp_send_ctrl_packet(global.conn, &rqst, sizeof(rqst));
|
|
|
27639a |
- global.conn->ka_state = KA_OUTSTANDING;
|
|
|
27639a |
+ if (pptp_send_ctrl_packet(global.conn, &rqst, sizeof(rqst))) {
|
|
|
27639a |
+ global.conn->ka_state = KA_OUTSTANDING;
|
|
|
27639a |
+ }
|
|
|
27639a |
}
|
|
|
27639a |
/* check incoming/outgoing call states for !IDLE && !ESTABLISHED */
|
|
|
27639a |
for (i = 0; i < vector_size(global.conn->call); i++) {
|