From fe6e1bd4af725e52bfe4249ea701f6bef7391240 Mon Sep 17 00:00:00 2001 From: goldsimon Date: Wed, 1 Mar 2017 22:08:05 +0100 Subject: [PATCH] httpd: LWIP_HTTPD_POST_MANUAL_WND: fixed double-free when httpd_post_data_recved is called nested from httpd_post_receive_data() (bug #50424) # Conflicts: # CHANGELOG --- src/apps/httpd/httpd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/apps/httpd/httpd.c b/src/apps/httpd/httpd.c index 7c2dfe62..43195d7c 100644 --- a/src/apps/httpd/httpd.c +++ b/src/apps/httpd/httpd.c @@ -1692,7 +1692,14 @@ http_post_rxpbuf(struct http_state *hs, struct pbuf *p) hs->post_content_len_left -= p->tot_len; } } +#if LWIP_HTTPD_SUPPORT_POST && LWIP_HTTPD_POST_MANUAL_WND + /* prevent connection being closed if httpd_post_data_recved() is called nested */ + hs->unrecved_bytes++; +#endif err = httpd_post_receive_data(hs, p); +#if LWIP_HTTPD_SUPPORT_POST && LWIP_HTTPD_POST_MANUAL_WND + hs->unrecved_bytes--; +#endif if (err != ERR_OK) { /* Ignore remaining content in case of application error */ hs->post_content_len_left = 0;