From 240cf62056358caa53d9e83067a4fa0407974b8c Mon Sep 17 00:00:00 2001 From: David van Moolenbroek Date: Fri, 10 Feb 2017 17:26:38 +0000 Subject: [PATCH] tcp: fix accept event on closed listening PCBs If LWIP_CALLBACK_API is not defined, but TCP_LISTEN_BACKLOG is, then the LWIP_EVENT_ACCEPT TCP event may be triggered for closed listening sockets. This case is just as disastrous for the event API as it is for the callback API, as there is no way for the event hook to tell whether the listening PCB is still around. Add the same protection against this case for TCP_LISTEN_BACKLOG as was already in place for LWIP_CALLBACK_API. Also remove one NULL check for LWIP_CALLBACK_API that had already become redundant for all callers, making the TCP_EVENT_ACCEPT code for that callback wrapper more in line with the rest of the wrappers. --- src/core/tcp_in.c | 4 +++- src/include/lwip/priv/tcp_priv.h | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/core/tcp_in.c b/src/core/tcp_in.c index 706e2635..301659c1 100644 --- a/src/core/tcp_in.c +++ b/src/core/tcp_in.c @@ -827,14 +827,16 @@ tcp_process(struct tcp_pcb *pcb) if (TCP_SEQ_BETWEEN(ackno, pcb->lastack+1, pcb->snd_nxt)) { pcb->state = ESTABLISHED; LWIP_DEBUGF(TCP_DEBUG, ("TCP connection established %"U16_F" -> %"U16_F".\n", inseg.tcphdr->src, inseg.tcphdr->dest)); +#if LWIP_CALLBACK_API || TCP_LISTEN_BACKLOG #if LWIP_CALLBACK_API LWIP_ASSERT("pcb->listener->accept != NULL", (pcb->listener == NULL) || (pcb->listener->accept != NULL)); +#endif if (pcb->listener == NULL) { /* listen pcb might be closed by now */ err = ERR_VAL; } else -#endif +#endif /* LWIP_CALLBACK_API || TCP_LISTEN_BACKLOG */ { tcp_backlog_accepted(pcb); /* Call the accept function. */ diff --git a/src/include/lwip/priv/tcp_priv.h b/src/include/lwip/priv/tcp_priv.h index ffffb977..cfcce782 100644 --- a/src/include/lwip/priv/tcp_priv.h +++ b/src/include/lwip/priv/tcp_priv.h @@ -179,7 +179,7 @@ err_t tcp_process_refused_data(struct tcp_pcb *pcb); #define TCP_EVENT_ACCEPT(lpcb,pcb,arg,err,ret) \ do { \ - if((lpcb != NULL) && ((lpcb)->accept != NULL)) \ + if((lpcb)->accept != NULL) \ (ret) = (lpcb)->accept((arg),(pcb),(err)); \ else (ret) = ERR_ARG; \ } while (0)