mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-06-30 18:09:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed pbuf leak when PPP session is aborted through pppSigHUP() (bug #35541: PPP Memory Leak)

Browse Source
This commit is contained in:
goldsimon 2012-02-16 12:55:14 +01:00
parent 5816bab6a2
commit ac2175fa7d
2 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG
View File

@ -76,6 +76,10 @@ HISTORY
++ Bugfixes:
2012-02-16: Simon Goldschmidt
* ppp.c: fixed pbuf leak when PPP session is aborted through pppSigHUP()
(bug #35541: PPP Memory Leak)
2012-02-16: Simon Goldschmidt
* etharp.c: fixed bug #35531: Impossible to send multicast without a gateway
(introduced when fixing bug# 33551)

26
src/netif/ppp/ppp.c
View File

@ -243,6 +243,7 @@ static void pppInputThread(void *arg);
#endif /* PPP_INPROC_OWNTHREAD */
static void pppDrop(PPPControlRx *pcrx);
static void pppInProc(PPPControlRx *pcrx, u_char *s, int l);
static void pppFreeCurrentInputPacket(PPPControlRx *pcrx);
#endif /* PPPOS_SUPPORT */
@ -551,6 +552,8 @@ pppOverSerialOpen(sio_fd_t fd, pppLinkStatusCB_fn linkStatusCB, void *linkStatus
pd = PPPERR_OPEN;
} else {
pc = &pppControl[pd];
/* input pbuf left over from last session? */
pppFreeCurrentInputPacket(&pc->rx);
/* @todo: is this correct or do I overwrite something? */
memset(pc, 0, sizeof(PPPControl));
pc->rx.pd = pd;
@ -1723,6 +1726,22 @@ out:
* Drop the input packet.
*/
static void
pppFreeCurrentInputPacket(PPPControlRx *pcrx)
{
if (pcrx->inHead != NULL) {
if (pcrx->inTail && (pcrx->inTail != pcrx->inHead)) {
pbuf_free(pcrx->inTail);
}
pbuf_free(pcrx->inHead);
pcrx->inHead = NULL;
}
pcrx->inTail = NULL;
}
/*
* Drop the input packet and increase error counters.
*/
static void
pppDrop(PPPControlRx *pcrx)
{
if (pcrx->inHead != NULL) {
@ -1730,13 +1749,8 @@ pppDrop(PPPControlRx *pcrx)
PPPDEBUG(LOG_INFO, ("pppDrop: %d:%.*H\n", pcrx->inHead->len, min(60, pcrx->inHead->len * 2), pcrx->inHead->payload));
#endif
PPPDEBUG(LOG_INFO, ("pppDrop: pbuf len=%d, addr %p\n", pcrx->inHead->len, (void*)pcrx->inHead));
if (pcrx->inTail && (pcrx->inTail != pcrx->inHead)) {
pbuf_free(pcrx->inTail);
}
pbuf_free(pcrx->inHead);
pcrx->inHead = NULL;
pcrx->inTail = NULL;
}
pppFreeCurrentInputPacket(pcrx);
#if VJ_SUPPORT
vj_uncompress_err(&pppControl[pcrx->pd].vjComp);
#endif /* VJ_SUPPORT */