vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

fix double free in grub_net_recv_tcp_packet

Browse source 
Using the http module to download config files, produces memory errors,
after the config file is downloaded.

The error was traced to the tcp stack in grub-core/net/tcp.c. The wrong
netbuff pointer was being freed in the clean up loop.

Changing the code to free the correct netbuff pointer removes the runtime
error.

Closes 42765.
This commit is contained in:
Curtis Larsen 2014-12-07 11:28:57 +03:00 committed by Andrei Borzenkov
parent ebb3d958aa
commit 06eadf5ebf
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -1,3 +1,8 @@
2014-12-07 Curtis Larsen <larsen@dixie.edu>
* grub-core/net/tcp.c (grub_net_recv_tcp_packet): Fix double
free when multiple empty segments were received (closes 42765).
2014-12-05 Andrei Borzenkov <arvidjaar@gmail.com> 2014-12-05 Andrei Borzenkov <arvidjaar@gmail.com>
* tests/util/grub-shell.in: Support --files also for netboot. * tests/util/grub-shell.in: Support --files also for netboot.

2
grub-core/net/tcp.c
View file

@ -918,7 +918,7 @@ grub_net_recv_tcp_packet (struct grub_net_buff *nb,
do_ack = 1; do_ack = 1;
} }
else else
grub_netbuff_free (nb); grub_netbuff_free (nb_top);
} }
if (do_ack) if (do_ack)
ack (sock); ack (sock);