mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-11-19 23:12:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed bug #37405 'err_tcp()' uses already freed 'netconn' object

Browse Source
This commit is contained in:
goldsimon 2012-09-26 21:50:42 +02:00
parent 99aea7eb6f
commit a4a41b9023
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG
View File

@ -80,6 +80,9 @@ HISTORY
++ Bugfixes: ++ Bugfixes:
2012-09-26: Simon Goldschmidt
* api_msg.c: fixed bug #37405 'err_tcp()' uses already freed 'netconn' object
2012-09-26: patch by Henrik Persson 2012-09-26: patch by Henrik Persson
* dhcp.c: patch #7843 Fix corner case with dhcp timeouts * dhcp.c: patch #7843 Fix corner case with dhcp timeouts

8
src/api/api_msg.c
View File

@ -456,6 +456,14 @@ accept_function(void *arg, struct tcp_pcb *newpcb, err_t err)
if (sys_mbox_trypost(&conn->acceptmbox, newconn) != ERR_OK) { if (sys_mbox_trypost(&conn->acceptmbox, newconn) != ERR_OK) {
/* When returning != ERR_OK, the pcb is aborted in tcp_process(), /* When returning != ERR_OK, the pcb is aborted in tcp_process(),
so do nothing here! */ so do nothing here! */
/* remove all references to this netconn from the pcb */
struct tcp_pcb* pcb = newconn->pcb.tcp;
tcp_arg(pcb, NULL);
tcp_recv(pcb, NULL);
tcp_sent(pcb, NULL);
tcp_poll(pcb, NULL, 4);
tcp_err(pcb, NULL);
/* remove reference from to the pcb from this netconn */
newconn->pcb.tcp = NULL; newconn->pcb.tcp = NULL;
/* no need to drain since we know the recvmbox is empty. */ /* no need to drain since we know the recvmbox is empty. */
sys_mbox_free(&newconn->recvmbox); sys_mbox_free(&newconn->recvmbox);