From 8d06d69bc448301d27cab1405efba9d876dd39da Mon Sep 17 00:00:00 2001 From: Jan Kiszka Date: Mon, 26 Sep 2011 21:29:56 +0200 Subject: [PATCH] slirp: Fix use after release on tcp_input ti points into the m buffer. But the latter may already be released right after the dodata: label. Move the test before the potential release. Signed-off-by: Jan Kiszka --- slirp/tcp_input.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/slirp/tcp_input.c b/slirp/tcp_input.c index 2f1a196b39..942aaf44f1 100644 --- a/slirp/tcp_input.c +++ b/slirp/tcp_input.c @@ -1156,6 +1156,16 @@ step6: tp->rcv_up = tp->rcv_nxt; dodata: + /* + * If this is a small packet, then ACK now - with Nagel + * congestion avoidance sender won't send more until + * he gets an ACK. + */ + if (ti->ti_len && (unsigned)ti->ti_len <= 5 && + ((struct tcpiphdr_2 *)ti)->first_char == (char)27) { + tp->t_flags |= TF_ACKNOW; + } + /* * Process the segment text, merging it into the TCP sequencing queue, * and arranging for acknowledgment of receipt if necessary. @@ -1234,18 +1244,6 @@ dodata: } } - /* - * If this is a small packet, then ACK now - with Nagel - * congestion avoidance sender won't send more until - * he gets an ACK. - * - * See above. - */ - if (ti->ti_len && (unsigned)ti->ti_len <= 5 && - ((struct tcpiphdr_2 *)ti)->first_char == (char)27) { - tp->t_flags |= TF_ACKNOW; - } - /* * Return any desired output. */