mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-06-30 18:09:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed bug #41318 (Bad memory ref in tcp_input() after tcp_close())

Browse Source
This commit is contained in:
sg 2015-03-21 21:19:10 +01:00
parent c00a62d37f
commit 33d5e646e5
4 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG
View File

@ -216,6 +216,10 @@ HISTORY
++ Bugfixes:
2015-03-21: Simon Goldschmidt
* tcp_impl.h, tcp.c, tcp_in.c: fixed bug #41318 (Bad memory ref in tcp_input()
after tcp_close())
2015-03-21: Simon Goldschmidt
* tcp_in.c: fixed bug #38468 (tcp_sent() not called on half-open connection for
data ACKed with the same ack as FIN)

7
src/core/tcp.c
View File

@ -193,7 +193,12 @@ tcp_close_shutdown(struct tcp_pcb *pcb, u8_t rst_on_unacked_data)
TCP_REG(&tcp_tw_pcbs, pcb);
} else {
/* CLOSE_WAIT: deallocate the pcb since we already sent a RST for it */
memp_free(MEMP_TCP_PCB, pcb);
if (tcp_input_pcb == pcb) {
/* prevent using a deallocated pcb: free it from tcp_input later */
tcp_trigger_input_pcb_close();
} else {
memp_free(MEMP_TCP_PCB, pcb);
}
}
return ERR_OK;
}

6
src/core/tcp_in.c
View File

@ -1767,4 +1767,10 @@ tcp_parseopt(struct tcp_pcb *pcb)
}
}
void
tcp_trigger_input_pcb_close(void)
{
recv_flags |= TF_CLOSED;
}
#endif /* LWIP_TCP */

1
src/include/lwip/tcp_impl.h
View File

@ -497,6 +497,7 @@ u32_t tcp_next_iss(void);
err_t tcp_keepalive(struct tcp_pcb *pcb);
err_t tcp_zero_window_probe(struct tcp_pcb *pcb);
void tcp_trigger_input_pcb_close(void);
#if TCP_CALCULATE_EFF_SEND_MSS
u16_t tcp_eff_send_mss_impl(u16_t sendmss, ipX_addr_t *dest