mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-12-28 09:19:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added 2 asserts in pbuf_realloc to prevent dereferencing a null pointer in invalid pbuf queues

Browse Source
This commit is contained in:
goldsimon 2008-08-26 19:34:18 +00:00
parent c779a9f29f
commit 6374766a55
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/core/pbuf.c
View File

@ -272,6 +272,7 @@ pbuf_realloc(struct pbuf *p, u16_t new_len)
u16_t rem_len; /* remaining length */ u16_t rem_len; /* remaining length */
s32_t grow; s32_t grow;
LWIP_ASSERT("pbuf_realloc: p != NULL", p != NULL);
LWIP_ASSERT("pbuf_realloc: sane p->type", p->type == PBUF_POOL || LWIP_ASSERT("pbuf_realloc: sane p->type", p->type == PBUF_POOL ||
p->type == PBUF_ROM || p->type == PBUF_ROM ||
p->type == PBUF_RAM || p->type == PBUF_RAM ||
@ -299,6 +300,7 @@ pbuf_realloc(struct pbuf *p, u16_t new_len)
q->tot_len += (u16_t)grow; q->tot_len += (u16_t)grow;
/* proceed to next pbuf in chain */ /* proceed to next pbuf in chain */
q = q->next; q = q->next;
LWIP_ASSERT("pbuf_realloc: q != NULL", q != NULL);
} }
/* we have now reached the new last pbuf (in q) */ /* we have now reached the new last pbuf (in q) */
/* rem_len == desired length for pbuf q */ /* rem_len == desired length for pbuf q */