mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-11-16 14:11:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Possible null-pointer dereference

Browse Source 
In assertion the pointer that is potentialy
null is dereferenced. The check for null was
located after.

(cherry picked from commit eba1b971c0)
This commit is contained in:
Mikhail Lappo 2017-03-22 15:42:48 +01:00 committed by goldsimon
parent 0623dc4038
commit 77c12bb124
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/api/api_msg.c
View File

@ -177,14 +177,20 @@ recv_udp(void *arg, struct udp_pcb *pcb, struct pbuf *p,
LWIP_ASSERT("recv_udp must have a pcb argument", pcb != NULL); LWIP_ASSERT("recv_udp must have a pcb argument", pcb != NULL);
LWIP_ASSERT("recv_udp must have an argument", arg != NULL); LWIP_ASSERT("recv_udp must have an argument", arg != NULL);
conn = (struct netconn *)arg; conn = (struct netconn *)arg;
if (conn == NULL) {
pbuf_free(p);
return;
}
LWIP_ASSERT("recv_udp: recv for wrong pcb!", conn->pcb.udp == pcb); LWIP_ASSERT("recv_udp: recv for wrong pcb!", conn->pcb.udp == pcb);
#if LWIP_SO_RCVBUF #if LWIP_SO_RCVBUF
SYS_ARCH_GET(conn->recv_avail, recv_avail); SYS_ARCH_GET(conn->recv_avail, recv_avail);
if ((conn == NULL) || !sys_mbox_valid(&conn->recvmbox) || if (!sys_mbox_valid(&conn->recvmbox) ||
((recv_avail + (int)(p->tot_len)) > conn->recv_bufsize)) { ((recv_avail + (int)(p->tot_len)) > conn->recv_bufsize)) {
#else /* LWIP_SO_RCVBUF */ #else /* LWIP_SO_RCVBUF */
if ((conn == NULL) || !sys_mbox_valid(&conn->recvmbox)) { if (!sys_mbox_valid(&conn->recvmbox)) {
#endif /* LWIP_SO_RCVBUF */ #endif /* LWIP_SO_RCVBUF */
pbuf_free(p); pbuf_free(p);
return; return;