OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

slirp: Fix use after release on tcp_input

Browse Source 
ti points into the m buffer. But the latter may already be released
right after the dodata: label. Move the test before the potential
release.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
This commit is contained in:
Jan Kiszka 2011-09-26 21:29:56 +02:00
parent 46f3069cba
commit 8d06d69bc4
1 changed files with 10 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
slirp/tcp_input.c
View File

@ -1156,6 +1156,16 @@ step6:
tp->rcv_up = tp->rcv_nxt;
dodata:
/*
* If this is a small packet, then ACK now - with Nagel
* congestion avoidance sender won't send more until
* he gets an ACK.
*/
if (ti->ti_len && (unsigned)ti->ti_len <= 5 &&
((struct tcpiphdr_2 *)ti)->first_char == (char)27) {
tp->t_flags |= TF_ACKNOW;
}
/*
* Process the segment text, merging it into the TCP sequencing queue,
* and arranging for acknowledgment of receipt if necessary.
@ -1234,18 +1244,6 @@ dodata:
}
}
/*
* If this is a small packet, then ACK now - with Nagel
* congestion avoidance sender won't send more until
* he gets an ACK.
*
* See above.
*/
if (ti->ti_len && (unsigned)ti->ti_len <= 5 &&
((struct tcpiphdr_2 *)ti)->first_char == (char)27) {
tp->t_flags |= TF_ACKNOW;
}
/*
* Return any desired output.
*/