summaryrefslogtreecommitdiff
path: root/src/api/api_msg.c
diff options
context:
space:
mode:
authorMikhail Lappo <[email protected]>2017-03-22 15:42:48 +0100
committerDirk Ziegelmeier <[email protected]>2017-03-22 15:50:34 +0100
commiteba1b971c024e489c4dadff98ed4a4c4aeb64465 (patch)
tree5179d8f41abf1cbf237adb34ddab78ba29f9e08d /src/api/api_msg.c
parent9e20fe2cfb01428e366e97fc0366cff9920ae921 (diff)
Possible null-pointer dereference
In assertion the pointer that is potentialy null is dereferenced. The check for null was located after.
Diffstat (limited to 'src/api/api_msg.c')
-rw-r--r--src/api/api_msg.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/src/api/api_msg.c b/src/api/api_msg.c
index 7a8c91e0..8c4ba90a 100644
--- a/src/api/api_msg.c
+++ b/src/api/api_msg.c
@@ -177,14 +177,20 @@ recv_udp(void *arg, struct udp_pcb *pcb, struct pbuf *p,
LWIP_ASSERT("recv_udp must have a pcb argument", pcb != NULL);
LWIP_ASSERT("recv_udp must have an argument", arg != NULL);
conn = (struct netconn *)arg;
+
+ if (conn == NULL) {
+ pbuf_free(p);
+ return;
+ }
+
LWIP_ASSERT("recv_udp: recv for wrong pcb!", conn->pcb.udp == pcb);
#if LWIP_SO_RCVBUF
SYS_ARCH_GET(conn->recv_avail, recv_avail);
- if ((conn == NULL) || !sys_mbox_valid(&conn->recvmbox) ||
+ if (!sys_mbox_valid(&conn->recvmbox) ||
((recv_avail + (int)(p->tot_len)) > conn->recv_bufsize)) {
#else /* LWIP_SO_RCVBUF */
- if ((conn == NULL) || !sys_mbox_valid(&conn->recvmbox)) {
+ if (!sys_mbox_valid(&conn->recvmbox)) {
#endif /* LWIP_SO_RCVBUF */
pbuf_free(p);
return;