[lwip-devel] [bug #27871] Calling tcp_abort() in recv callback can lead to accessing unallocated memory

[Simon Goldschmidt]

Update of bug #27871 (project lwip):

                  Status:                    None => Fixed                  
             Assigned to:                    None => goldsimon              

    _______________________________________________________

Follow-up Comment #6:

Fixed by checking the return value of TCP_EVENT_xxx and not accessing the pcb
pointer after that if err == ERR_ABRT.

This effectively means that ERR_ABRT must only be used when the application
has called tcp_abort() from withing the callback *and* when calling
tcp_abort() from such a callback, ERR_ABRT *must* be returned (updated the
docs and comments, too).

Is this OK for you all?

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?27871>

_______________________________________________
  Nachricht geschickt von/durch Savannah
  http://savannah.nongnu.org/