mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-12-26 03:16:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

httpd: LWIP_HTTPD_POST_MANUAL_WND: fixed double-free when httpd_post_data_recved is called nested from httpd_post_receive_data() (bug #50424)

Browse Source
This commit is contained in:
goldsimon 2017-03-01 22:08:05 +01:00
parent 5f0fbdcde9
commit 05a595f745
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGELOG
View File

@ -29,8 +29,12 @@ HISTORY
++ Bugfixes: ++ Bugfixes:
2017-03-01: Simon Goldschmidt
* httpd: LWIP_HTTPD_POST_MANUAL_WND: fixed double-free when httpd_post_data_recved
is called nested from httpd_post_receive_data() (bug #50424)
2017-02-28: David van Moolenbroek/Simon Goldschmidt 2017-02-28: David van Moolenbroek/Simon Goldschmidt
tcp: fixed bug #50418: LWIP_EVENT_API: fix invalid calbacks for SYN_RCVD pcb * tcp: fixed bug #50418: LWIP_EVENT_API: fix invalid calbacks for SYN_RCVD pcb
2017-02-24: Simon Goldschmidt 2017-02-24: Simon Goldschmidt
* sockets.c: fixed close race conditions in lwip_select (for LWIP_NETCONN_FULLDUPLEX) * sockets.c: fixed close race conditions in lwip_select (for LWIP_NETCONN_FULLDUPLEX)

7
src/apps/httpd/httpd.c
View File

@ -1692,7 +1692,14 @@ http_post_rxpbuf(struct http_state *hs, struct pbuf *p)
hs->post_content_len_left -= p->tot_len; hs->post_content_len_left -= p->tot_len;
} }
} }
#if LWIP_HTTPD_SUPPORT_POST && LWIP_HTTPD_POST_MANUAL_WND
/* prevent connection being closed if httpd_post_data_recved() is called nested */
hs->unrecved_bytes++;
#endif
err = httpd_post_receive_data(hs, p); err = httpd_post_receive_data(hs, p);
#if LWIP_HTTPD_SUPPORT_POST && LWIP_HTTPD_POST_MANUAL_WND
hs->unrecved_bytes--;
#endif
if (err != ERR_OK) { if (err != ERR_OK) {
/* Ignore remaining content in case of application error */ /* Ignore remaining content in case of application error */
hs->post_content_len_left = 0; hs->post_content_len_left = 0;