From dbd6d7ec8da429da9f922e3df2943b80e2f73194 Mon Sep 17 00:00:00 2001
From: goldsimon <goldsimon>
Date: Wed, 15 Apr 2009 14:57:32 +0000
Subject: [PATCH] bug #26027: netbuf_chain resulted in pbuf memory leak

---
 CHANGELOG        | 3 +++
 src/api/netbuf.c | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 99b56322..b4108b49 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -19,6 +19,9 @@ HISTORY
 
   ++ New features:
 
+  2009-04-15 Simon Goldschmidt
+  * netbuf.c: bug #26027: netbuf_chain resulted in pbuf memory leak
+
   2009-04-15 Simon Goldschmidt
   * sockets.c, ppp.c: bug #25763: corrected 4 occurrences of SMEMCPY to MEMCPY
 
diff --git a/src/api/netbuf.c b/src/api/netbuf.c
index 27120eb5..af44eefc 100644
--- a/src/api/netbuf.c
+++ b/src/api/netbuf.c
@@ -158,14 +158,14 @@ netbuf_ref(struct netbuf *buf, const void *dataptr, u16_t size)
  * Chain one netbuf to another (@see pbuf_chain)
  *
  * @param head the first netbuf
- * @param tail netbuf to chain after head
+ * @param tail netbuf to chain after head, freed by this function, may not be reference after returning
  */
 void
 netbuf_chain(struct netbuf *head, struct netbuf *tail)
 {
   LWIP_ERROR("netbuf_ref: invalid head", (head != NULL), return;);
   LWIP_ERROR("netbuf_chain: invalid tail", (tail != NULL), return;);
-  pbuf_chain(head->p, tail->p);
+  pbuf_cat(head->p, tail->p);
   head->ptr = head->p;
   memp_free(MEMP_NETBUF, tail);
 }