From 150b4fb4f6069cd2cc1b66e47a848b41d1f7d453 Mon Sep 17 00:00:00 2001
From: goldsimon <goldsimon@gmx.de>
Date: Wed, 22 Aug 2012 21:59:02 +0200
Subject: [PATCH] fixed bug #37166: memp_sanity check loops itself

---
 CHANGELOG       |  3 +++
 src/core/memp.c | 15 ++++++++-------
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index b3f6890f..8f7af0f8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -80,6 +80,9 @@ HISTORY
 
  ++ Bugfixes:
 
+  2012-08-22: Simon Goldschmidt
+  * memp.c: fixed bug #37166: memp_sanity check loops itself
+
   2012-08-13: Simon Goldschmidt
   * dhcp.c: fixed bug #36645: Calling dhcp_release before dhcp_start
     dereferences NULL
diff --git a/src/core/memp.c b/src/core/memp.c
index 3496f682..1323463e 100644
--- a/src/core/memp.c
+++ b/src/core/memp.c
@@ -179,19 +179,20 @@ static u8_t memp_memory[MEM_ALIGNMENT - 1
 
 #if MEMP_SANITY_CHECK
 /**
- * Check that memp-lists don't form a circle
+ * Check that memp-lists don't form a circle, using "Floyd's cycle-finding algorithm".
  */
 static int
 memp_sanity(void)
 {
-  s16_t i, c;
-  struct memp *m, *n;
+  s16_t i;
+  struct memp *t, *h;
 
   for (i = 0; i < MEMP_MAX; i++) {
-    for (m = memp_tab[i]; m != NULL; m = m->next) {
-      c = 1;
-      for (n = memp_tab[i]; n != NULL; n = n->next) {
-        if (n == m && --c < 0) {
+    t = memp_tab[i];
+    if(t != NULL) {
+      for (h = t->next; (t != NULL) && (h != NULL); t = t->next,
+        h = (((h->next != NULL) && (h->next->next != NULL)) ? h->next->next : NULL)) {
+        if (t == h) {
           return 0;
         }
       }