proxmox-mirrors/qemu
1
0
Fork 0
mirror of https://git.proxmox.com/git/qemu synced 2025-08-15 23:14:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

slirp: Fix use after release on tcp_input

Browse Source 
ti points into the m buffer. But the latter may already be released
right after the dodata: label. Move the test before the potential
release.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
This commit is contained in:
Jan Kiszka 2011-09-26 21:29:56 +02:00
parent 46f3069cba
commit 8d06d69bc4
1 changed files with 10 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
slirp/tcp_input.c
View File

@ -1156,6 +1156,16 @@ step6:
tp->rcv_up = tp->rcv_nxt; tp->rcv_up = tp->rcv_nxt;
dodata: dodata:
/*
* If this is a small packet, then ACK now - with Nagel
* congestion avoidance sender won't send more until
* he gets an ACK.
*/
if (ti->ti_len && (unsigned)ti->ti_len <= 5 &&
((struct tcpiphdr_2 *)ti)->first_char == (char)27) {
tp->t_flags |= TF_ACKNOW;
}
/* /*
* Process the segment text, merging it into the TCP sequencing queue, * Process the segment text, merging it into the TCP sequencing queue,
* and arranging for acknowledgment of receipt if necessary. * and arranging for acknowledgment of receipt if necessary.
@ -1234,18 +1244,6 @@ dodata:
} }
} }
/*
* If this is a small packet, then ACK now - with Nagel
* congestion avoidance sender won't send more until
* he gets an ACK.
*
* See above.
*/
if (ti->ti_len && (unsigned)ti->ti_len <= 5 &&
((struct tcpiphdr_2 *)ti)->first_char == (char)27) {
tp->t_flags |= TF_ACKNOW;
}
/* /*
* Return any desired output. * Return any desired output.
*/ */