mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-11-19 23:12:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

lwiperf: fix double-free of pcb on error

Browse Source 
See bug #59841 (PCB double-free happened at lwiperf TCP error)

Signed-off-by: Simon Goldschmidt <goldsimon@gmx.de>
This commit is contained in:
Simon Goldschmidt 2021-01-28 20:00:11 +01:00
parent 9b040624c0
commit fc5b6f7b0e
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/apps/lwiperf/lwiperf.c
View File

@ -264,7 +264,7 @@ lwiperf_tcp_close(lwiperf_state_tcp_t *conn, enum lwiperf_report_type report_typ
/* don't want to wait for free memory here... */ /* don't want to wait for free memory here... */
tcp_abort(conn->conn_pcb); tcp_abort(conn->conn_pcb);
} }
} else { } else if (conn->server_pcb != NULL) {
/* no conn pcb, this is the listener pcb */ /* no conn pcb, this is the listener pcb */
err = tcp_close(conn->server_pcb); err = tcp_close(conn->server_pcb);
LWIP_ASSERT("error", err == ERR_OK); LWIP_ASSERT("error", err == ERR_OK);
@ -566,6 +566,11 @@ lwiperf_tcp_err(void *arg, err_t err)
{ {
lwiperf_state_tcp_t *conn = (lwiperf_state_tcp_t *)arg; lwiperf_state_tcp_t *conn = (lwiperf_state_tcp_t *)arg;
LWIP_UNUSED_ARG(err); LWIP_UNUSED_ARG(err);
/* pcb is already deallocated, prevent double-free */
conn->conn_pcb = NULL;
conn->server_pcb = NULL;
lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_REMOTE); lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_REMOTE);
} }