mirror of
https://github.com/lwip-tcpip/lwip.git
synced 2024-12-25 00:14:02 +00:00
lwiperf: fix double-free of pcb on error
See bug #59841 (PCB double-free happened at lwiperf TCP error) Signed-off-by: Simon Goldschmidt <goldsimon@gmx.de>
This commit is contained in:
parent
9b040624c0
commit
fc5b6f7b0e
@ -264,7 +264,7 @@ lwiperf_tcp_close(lwiperf_state_tcp_t *conn, enum lwiperf_report_type report_typ
|
||||
/* don't want to wait for free memory here... */
|
||||
tcp_abort(conn->conn_pcb);
|
||||
}
|
||||
} else {
|
||||
} else if (conn->server_pcb != NULL) {
|
||||
/* no conn pcb, this is the listener pcb */
|
||||
err = tcp_close(conn->server_pcb);
|
||||
LWIP_ASSERT("error", err == ERR_OK);
|
||||
@ -566,6 +566,11 @@ lwiperf_tcp_err(void *arg, err_t err)
|
||||
{
|
||||
lwiperf_state_tcp_t *conn = (lwiperf_state_tcp_t *)arg;
|
||||
LWIP_UNUSED_ARG(err);
|
||||
|
||||
/* pcb is already deallocated, prevent double-free */
|
||||
conn->conn_pcb = NULL;
|
||||
conn->server_pcb = NULL;
|
||||
|
||||
lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_REMOTE);
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user