mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-12-25 00:14:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Possible null-pointer dereference

Browse Source 
In assertion the pointer that is potentialy
null is dereferenced. The check for null was
located after.
This commit is contained in:
Mikhail Lappo 2017-03-22 15:42:48 +01:00 committed by Dirk Ziegelmeier
parent 9e20fe2cfb
commit eba1b971c0
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/api/api_msg.c
View File

@ -177,14 +177,20 @@ recv_udp(void *arg, struct udp_pcb *pcb, struct pbuf *p,
LWIP_ASSERT("recv_udp must have a pcb argument", pcb != NULL); LWIP_ASSERT("recv_udp must have a pcb argument", pcb != NULL);
LWIP_ASSERT("recv_udp must have an argument", arg != NULL); LWIP_ASSERT("recv_udp must have an argument", arg != NULL);
conn = (struct netconn *)arg; conn = (struct netconn *)arg;
if (conn == NULL) {
pbuf_free(p);
return;
}
LWIP_ASSERT("recv_udp: recv for wrong pcb!", conn->pcb.udp == pcb); LWIP_ASSERT("recv_udp: recv for wrong pcb!", conn->pcb.udp == pcb);
#if LWIP_SO_RCVBUF #if LWIP_SO_RCVBUF
SYS_ARCH_GET(conn->recv_avail, recv_avail); SYS_ARCH_GET(conn->recv_avail, recv_avail);
if ((conn == NULL) || !sys_mbox_valid(&conn->recvmbox) || if (!sys_mbox_valid(&conn->recvmbox) ||
((recv_avail + (int)(p->tot_len)) > conn->recv_bufsize)) { ((recv_avail + (int)(p->tot_len)) > conn->recv_bufsize)) {
#else /* LWIP_SO_RCVBUF */ #else /* LWIP_SO_RCVBUF */
if ((conn == NULL) || !sys_mbox_valid(&conn->recvmbox)) { if (!sys_mbox_valid(&conn->recvmbox)) {
#endif /* LWIP_SO_RCVBUF */ #endif /* LWIP_SO_RCVBUF */
pbuf_free(p); pbuf_free(p);
return; return;