Skip to content

Commit ea55863

Browse files
authored
Fix potential leak in TCPEndPoint::LwIPHandleDataReceived (#11447)
#### Problem `TCPEndPoint::LwIPHandleDataReceived()` receives a packet buffer and, in the normal case, forwards its ownership via `PostEvent()`. If that fails, `LwIPHandleDataReceived()` is responsible for freeing the pbuf, but doesn't. From LwIP documentation, “If the callback function returns ERR_OK or ERR_ABRT it must have freed the pbuf”. #### Change overview Call `pbuf_free()` if `PostEvent()` fails. #### Testing None; we don't have any way to instrument LwIP to verify this.
1 parent 618763d commit ea55863

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

src/inet/TCPEndPoint.cpp

+6
Original file line numberDiff line numberDiff line change
@@ -1086,7 +1086,13 @@ err_t TCPEndPoint::LwIPHandleDataReceived(void * arg, struct tcp_pcb * tpcb, str
10861086
res = ERR_ABRT;
10871087

10881088
if (res != ERR_OK)
1089+
{
1090+
if (p != nullptr)
1091+
{
1092+
pbuf_free(p);
1093+
}
10891094
tcp_abort(tpcb);
1095+
}
10901096

10911097
return res;
10921098
}

0 commit comments

Comments
 (0)