Fix memory leaks.

When pbufs are chained, the second pbuf must be freed, if no higher level
application refers to it any longer.
This commit is contained in:
davidhaas 2003-04-09 20:28:15 +00:00
parent 18a215e6a8
commit 50f47f18c1
2 changed files with 8 additions and 2 deletions

View File

@ -948,6 +948,7 @@ tcp_receive(struct tcp_pcb *pcb)
the application. */ the application. */
if(recv_data) { if(recv_data) {
pbuf_chain(recv_data, cseg->p); pbuf_chain(recv_data, cseg->p);
pbuf_free(cseg->p);
} else { } else {
recv_data = cseg->p; recv_data = cseg->p;
} }

View File

@ -213,6 +213,7 @@ tcp_enqueue(struct tcp_pcb *pcb, void *arg, u16_t len,
/* Chain the headers and data pbufs together. */ /* Chain the headers and data pbufs together. */
pbuf_chain(seg->p, p); pbuf_chain(seg->p, p);
pbuf_free(p);
} }
/* Now that there are more segments queued, we check again if the /* Now that there are more segments queued, we check again if the
@ -287,6 +288,10 @@ tcp_enqueue(struct tcp_pcb *pcb, void *arg, u16_t len,
/* Remove TCP header from first segment. */ /* Remove TCP header from first segment. */
pbuf_header(queue->p, -TCP_HLEN); pbuf_header(queue->p, -TCP_HLEN);
pbuf_chain(useg->p, queue->p); pbuf_chain(useg->p, queue->p);
/* Free buffer which was merged. Note that the previous pbuf_chain call
* will have incremented the ref count, so here the ref count will still
* be 1 for the 1 pointer still being used on this buffer. */
pbuf_free(queue->p);
useg->len += queue->len; useg->len += queue->len;
useg->next = queue->next; useg->next = queue->next;