riot-ci/RIOT
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ng_pktbuf_static: check if pkt is in buffer before derefencing in ng_pktbuf_release

Browse Source
This commit is contained in:
daniel-k 2015-08-07 17:43:30 +02:00
parent ffc6d31bab
commit 420d5e48ca
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/include/net/ng_pktbuf.h
View File

@ -141,6 +141,8 @@ void ng_pktbuf_hold(ng_pktsnip_t *pkt, unsigned int num);
* @brief Decreases ng_pktsnip_t::users of @p pkt atomically and removes it if it * @brief Decreases ng_pktsnip_t::users of @p pkt atomically and removes it if it
* reaches 0. * reaches 0.
* *
* @pre All snips of @p pkt must be in the packet buffer.
*
* @param[in] pkt A packet. * @param[in] pkt A packet.
*/ */
void ng_pktbuf_release(ng_pktsnip_t *pkt); void ng_pktbuf_release(ng_pktsnip_t *pkt);

4
sys/net/crosslayer/ng_pktbuf_static/ng_pktbuf_static.c
View File

@ -198,7 +198,9 @@ void ng_pktbuf_release(ng_pktsnip_t *pkt)
{ {
mutex_lock(&_mutex); mutex_lock(&_mutex);
while (pkt) { while (pkt) {
ng_pktsnip_t *tmp = pkt->next; ng_pktsnip_t *tmp;
assert(_pktbuf_contains(pkt));
tmp = pkt->next;
if (pkt->users == 1) { if (pkt->users == 1) {
pkt->users = 0; /* not necessary but to be on the safe side */ pkt->users = 0; /* not necessary but to be on the safe side */
_pktbuf_free(pkt->data, pkt->size); _pktbuf_free(pkt->data, pkt->size);