mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-11-19 05:10:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #34526: nd6_queue_packet() frees too much if out-of-memory

Browse Source 
Change-Id: Ib7ac0cb1b5a5389dd5449a908485493bd085ba9d
This commit is contained in:
Ivan Delamer 2011-10-26 14:31:48 -06:00
parent 0fb07ba328
commit 2ce17a724a
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/core/ipv6/nd6.c
View File

@ -1543,10 +1543,11 @@ nd6_queue_packet(s8_t neighbor_index, struct pbuf * q)
if(copy_needed) { if(copy_needed) {
/* copy the whole packet into new pbufs */ /* copy the whole packet into new pbufs */
p = pbuf_alloc(PBUF_LINK, q->tot_len, PBUF_RAM); p = pbuf_alloc(PBUF_LINK, q->tot_len, PBUF_RAM);
if ((p == NULL) && (neighbor_cache[neighbor_index].q != NULL)) { while ((p == NULL) && (neighbor_cache[neighbor_index].q != NULL)) {
/* Free oldest packet (as per RFC recommendation) */ /* Free oldest packet (as per RFC recommendation) */
r = neighbor_cache[neighbor_index].q; r = neighbor_cache[neighbor_index].q;
neighbor_cache[neighbor_index].q = r->next; neighbor_cache[neighbor_index].q = r->next;
r->next = NULL;
nd6_free_q(r); nd6_free_q(r);
p = pbuf_alloc(PBUF_LINK, q->tot_len, PBUF_RAM); p = pbuf_alloc(PBUF_LINK, q->tot_len, PBUF_RAM);
} }
@ -1570,6 +1571,7 @@ nd6_queue_packet(s8_t neighbor_index, struct pbuf * q)
/* Free oldest packet (as per RFC recommendation) */ /* Free oldest packet (as per RFC recommendation) */
r = neighbor_cache[neighbor_index].q; r = neighbor_cache[neighbor_index].q;
neighbor_cache[neighbor_index].q = r->next; neighbor_cache[neighbor_index].q = r->next;
r->next = NULL;
nd6_free_q(r); nd6_free_q(r);
new_entry = (struct nd6_q_entry *)memp_malloc(MEMP_ND6_QUEUE); new_entry = (struct nd6_q_entry *)memp_malloc(MEMP_ND6_QUEUE);
} }