mirror of
https://github.com/lwip-tcpip/lwip.git
synced 2024-10-05 22:29:49 +00:00
Fixed issue in pbuf_take(): old pbuf of type PBUF_REF was being referenced
after being freed. Also, it was not being freed if it had been the first buffer in chain. It still needs to be freed then.
This commit is contained in:
parent
9f3511231a
commit
82a32be1d6
@ -825,13 +825,6 @@ pbuf_take(struct pbuf *f)
|
|||||||
/* prev->next == p at this point */
|
/* prev->next == p at this point */
|
||||||
/* break chain and insert new pbuf instead */
|
/* break chain and insert new pbuf instead */
|
||||||
prev->next = q;
|
prev->next = q;
|
||||||
/* p is no longer pointed to by prev or by our caller,
|
|
||||||
* as the caller must do p = pbuf_take(p); so free it
|
|
||||||
* from reference through linkage.
|
|
||||||
* note that we have set p->next to NULL already so that
|
|
||||||
* we will not free the rest of the chain by accident.
|
|
||||||
*/
|
|
||||||
pbuf_free(p);
|
|
||||||
/* prev == NULL, so we replaced the top pbuf of the chain */
|
/* prev == NULL, so we replaced the top pbuf of the chain */
|
||||||
} else
|
} else
|
||||||
top = q;
|
top = q;
|
||||||
@ -842,6 +835,13 @@ pbuf_take(struct pbuf *f)
|
|||||||
/* do not copy ref, since someone else might be using the old buffer */
|
/* do not copy ref, since someone else might be using the old buffer */
|
||||||
/* pbuf is not freed, as this is the responsibility of the application */
|
/* pbuf is not freed, as this is the responsibility of the application */
|
||||||
DEBUGF(PBUF_DEBUG, ("pbuf_take: replaced PBUF_REF %p with %p\n", (void *)p, (void *)q));
|
DEBUGF(PBUF_DEBUG, ("pbuf_take: replaced PBUF_REF %p with %p\n", (void *)p, (void *)q));
|
||||||
|
/* p is no longer pointed to by prev or by our caller,
|
||||||
|
* as the caller must do p = pbuf_take(p); so free it
|
||||||
|
* from reference through linkage.
|
||||||
|
* note that we have set p->next to NULL already so that
|
||||||
|
* we will not free the rest of the chain by accident.
|
||||||
|
*/
|
||||||
|
pbuf_free(p);
|
||||||
p = q;
|
p = q;
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
|
Loading…
Reference in New Issue
Block a user