commit 5b8b5d459e7dd890724515bbfad86c705234f9ec
author goldsimon <goldsimon@gmx.de> Wed Sep 26 21:50:42 2012 +0200
committer goldsimon <goldsimon@gmx.de> Wed Sep 26 22:07:16 2012 +0200
tree de271c114c2aac0956fb77aadc787bf8fa75ef3d
parent 6d8dee6d685f2c0cdd55424bf5dde32349cf1d3e

fixed bug #37405 'err_tcp()' uses already freed 'netconn' object

CHANGELOG

diff --git a/CHANGELOG b/CHANGELOG
index f7cf259..c502b00 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -66,6 +66,9 @@
 
  ++ Bugfixes:
 
+  2012-09-26: Simon Goldschmidt
+  * api_msg.c: fixed bug #37405 'err_tcp()' uses already freed 'netconn' object
+
   2012-09-26: patch by Henrik Persson
   * dhcp.c: patch #7843 Fix corner case with dhcp timeouts
 

src/api/api_msg.c

diff --git a/src/api/api_msg.c b/src/api/api_msg.c
index 88afb8f..d4e44b9 100644
--- a/src/api/api_msg.c
+++ b/src/api/api_msg.c
@@ -456,6 +456,14 @@
   if (sys_mbox_trypost(&conn->acceptmbox, newconn) != ERR_OK) {
     /* When returning != ERR_OK, the pcb is aborted in tcp_process(),
        so do nothing here! */
+    /* remove all references to this netconn from the pcb */
+    struct tcp_pcb* pcb = newconn->pcb.tcp;
+    tcp_arg(pcb, NULL);
+    tcp_recv(pcb, NULL);
+    tcp_sent(pcb, NULL);
+    tcp_poll(pcb, NULL, 4);
+    tcp_err(pcb, NULL);
+    /* remove reference from to the pcb from this netconn */
     newconn->pcb.tcp = NULL;
     /* no need to drain since we know the recvmbox is empty. */
     sys_mbox_free(&newconn->recvmbox);