From 2fd83c9d2edecf8fbaa318361ce8ad2da8c41731 Mon Sep 17 00:00:00 2001
From: goldsimon <goldsimon@gmx.de>
Date: Tue, 16 Jan 2018 06:54:28 +0100
Subject: [PATCH] lwiperf: fix double-free of pbufs on recv error

---
 src/apps/lwiperf/lwiperf.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/apps/lwiperf/lwiperf.c b/src/apps/lwiperf/lwiperf.c
index 8c95d579..f8b31ae4 100644
--- a/src/apps/lwiperf/lwiperf.c
+++ b/src/apps/lwiperf/lwiperf.c
@@ -434,13 +434,13 @@ lwiperf_tcp_recv(void *arg, struct tcp_pcb *tpcb, struct pbuf *p, err_t err)
     if (p->tot_len < sizeof(lwiperf_settings_t)) {
       lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_LOCAL_DATAERROR);
       pbuf_free(p);
-      return ERR_VAL;
+      return ERR_OK;
     }
     if (!conn->have_settings_buf) {
       if (pbuf_copy_partial(p, &conn->settings, sizeof(lwiperf_settings_t), 0) != sizeof(lwiperf_settings_t)) {
         lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_LOCAL);
         pbuf_free(p);
-        return ERR_VAL;
+        return ERR_OK;
       }
       conn->have_settings_buf = 1;
       if ((conn->settings.flags & PP_HTONL(LWIPERF_FLAGS_ANSWER_TEST | LWIPERF_FLAGS_ANSWER_NOW)) ==
@@ -450,14 +450,14 @@ lwiperf_tcp_recv(void *arg, struct tcp_pcb *tpcb, struct pbuf *p, err_t err)
         if (err2 != ERR_OK) {
           lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_LOCAL_TXERROR);
           pbuf_free(p);
-          return err2;
+          return ERR_OK;
         }
       }
     } else {
       if (pbuf_memcmp(p, 0, &conn->settings, sizeof(lwiperf_settings_t)) != 0) {
         lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_LOCAL_DATAERROR);
         pbuf_free(p);
-        return ERR_VAL;
+        return ERR_OK;
       }
     }
     conn->bytes_transferred += sizeof(lwiperf_settings_t);
@@ -488,7 +488,7 @@ lwiperf_tcp_recv(void *arg, struct tcp_pcb *tpcb, struct pbuf *p, err_t err)
       } else {
         lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_LOCAL_DATAERROR);
         pbuf_free(p);
-        return ERR_VAL;
+        return ERR_OK;
       }
     }
 #endif