From 5c892288783527808adcafd712ddabd1b5389ec2 Mon Sep 17 00:00:00 2001
From: goldsimon <goldsimon>
Date: Wed, 16 May 2007 19:54:54 +0000
Subject: [PATCH] Fix bug #19729: free pbuf if netif->input() returns !=
 ERR_OK.

---
 CHANGELOG          |  4 ++++
 src/netif/loopif.c | 17 ++++++++++++++---
 src/netif/slipif.c |  5 ++++-
 3 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index ffa307e9..8479ac89 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -158,6 +158,10 @@ HISTORY
 
   ++ Bug fixes:
 
+  2007-05-16 Simon Goldschmidt
+  * loopif.c, slipif.c: Fix bug #19729: free pbuf if netif->input() returns
+    != ERR_OK.
+
   2007-05-16 Simon Goldschmidt
   * api_msg.c, udp.c: If a udp_pcb has a local_ip set, check if it is the same
     as the one of the netif used for sending to prevent sending from old
diff --git a/src/netif/loopif.c b/src/netif/loopif.c
index 97278142..6b472362 100644
--- a/src/netif/loopif.c
+++ b/src/netif/loopif.c
@@ -61,6 +61,11 @@ loopif_poll(struct netif *netif)
   struct pbuf *in = NULL;
   struct loopif_private *priv = (struct loopif_private*)netif->state;
 
+  LWIP_ASSERT("priv != NULL", priv != NULL);
+  if(priv == NULL) {
+  	return;
+  }
+
   do {
     /* Get a packet from the list. With SYS_LIGHTWEIGHT_PROT=1, this is protected */
     SYS_ARCH_PROTECT(lev);
@@ -82,10 +87,13 @@ loopif_poll(struct netif *netif)
         in->next = NULL;
         LWIP_ASSERT("packet must not consist of multiple pbufs!", in->len == in->tot_len);
       }
-      netif->input(in, netif);
+      if(netif->input(in, netif) != ERR_OK) {
+      	pbuf_free(in);
+      	in = NULL;
+      }
     }
   /* go on while there is a packet on the list */
-  } while(in != NULL);
+  } while(priv->first != NULL);
 }
 #endif /* LWIP_LOOPIF_MULTITHREADING */
 
@@ -122,7 +130,10 @@ loopif_output(struct netif *netif, struct pbuf *p,
   /* Multithreading environment, netif->input() is supposed to put the packet
      into a mailbox, so we can safely call it here without risking to re-enter
      functions that are not reentrant (TCP!!!) */
-  netif->input(r, netif);
+  if(netif->input(r, netif) != ERR_OK) {
+  	pbuf_free(r);
+  	r = NULL;
+  }
 #else /* LWIP_LOOPIF_MULTITHREADING */
   /* Raw API without threads: put the packet on a linked list which gets emptied
      through calling loopif_poll(). */
diff --git a/src/netif/slipif.c b/src/netif/slipif.c
index dd8db208..d2107271 100644
--- a/src/netif/slipif.c
+++ b/src/netif/slipif.c
@@ -182,7 +182,10 @@ slipif_loop(void *nf)
 
   while (1) {
     p = slipif_input(netif);
-    netif->input(p, netif);
+    if(netif->input(p, netif) != ERR_OK) {
+    	pbuf_free(p);
+    	p = NULL;
+    }
   }
 }