Changeset 3391 in vbox for trunk/src/VBox/Devices/Network

Timestamp:

Jul 3, 2007 2:10:47 PM (18 years ago)

Author:

vboxsync

Message:

Fixed slirp: a deallocated memory was accessed.

File:

• trunk/src/VBox/Devices/Network/slirp/tcp_input.c (modified) (3 diffs)

trunk/src/VBox/Devices/Network/slirp/tcp_input.c

@@ -241 +241 @@
         int ret;
 /*      int ts_present = 0; */
+        int mbuf_freed = 0;
 
         DEBUG_CALL("tcp_input");
@@ -1347 +1348 @@
                 len = so->so_rcv.sb_datalen - (tp->rcv_adv - tp->rcv_nxt);
         } else {
-                m_free(pData, m);
+                mbuf_freed = 1; /* The mbuf must be freed, but only when its content is not needed anymore. */
                 tiflags &= ~TH_FIN;
         }
@@ -1434 +1435 @@
         }
 
+        if (mbuf_freed) {
+                m_free(pData, m);
+        }
         /*
          * Return any desired output.