|
From: | Simon Goldschmidt |
Subject: | [lwip-devel] [bug #27871] Calling tcp_abort() in recv callback can lead to accessing unallocated memory |
Date: | Wed, 27 Jan 2010 17:24:08 +0000 |
User-agent: | Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 |
Update of bug #27871 (project lwip): Status: None => Fixed Assigned to: None => goldsimon _______________________________________________________ Follow-up Comment #6: Fixed by checking the return value of TCP_EVENT_xxx and not accessing the pcb pointer after that if err == ERR_ABRT. This effectively means that ERR_ABRT must only be used when the application has called tcp_abort() from withing the callback *and* when calling tcp_abort() from such a callback, ERR_ABRT *must* be returned (updated the docs and comments, too). Is this OK for you all? _______________________________________________________ Reply to this item at: <http://savannah.nongnu.org/bugs/?27871> _______________________________________________ Nachricht geschickt von/durch Savannah http://savannah.nongnu.org/
[Prev in Thread] | Current Thread | [Next in Thread] |