mirror of
https://github.com/lwip-tcpip/lwip.git
synced 2024-10-03 21:32:08 +00:00
tcp: Fix double free in tcp_split_unsent_seg()
Fixes bug #57377 (found by Hiromasa Ito).
This commit is contained in:
parent
ea111c511e
commit
e80d4ff2cc
@ -913,6 +913,7 @@ tcp_split_unsent_seg(struct tcp_pcb *pcb, u16_t split)
|
|||||||
|
|
||||||
seg = tcp_create_segment(pcb, p, remainder_flags, lwip_ntohl(useg->tcphdr->seqno) + split, optflags);
|
seg = tcp_create_segment(pcb, p, remainder_flags, lwip_ntohl(useg->tcphdr->seqno) + split, optflags);
|
||||||
if (seg == NULL) {
|
if (seg == NULL) {
|
||||||
|
p = NULL; /* Freed by tcp_create_segment */
|
||||||
LWIP_DEBUGF(TCP_OUTPUT_DEBUG | LWIP_DBG_LEVEL_SERIOUS,
|
LWIP_DEBUGF(TCP_OUTPUT_DEBUG | LWIP_DBG_LEVEL_SERIOUS,
|
||||||
("tcp_split_unsent_seg: could not create new TCP segment\n"));
|
("tcp_split_unsent_seg: could not create new TCP segment\n"));
|
||||||
goto memerr;
|
goto memerr;
|
||||||
|
Loading…
Reference in New Issue
Block a user