From 24a15a69a8b9d3079cdecbf65329ec0e2e97bd61 Mon Sep 17 00:00:00 2001 From: Michael Lotz Date: Sun, 4 Dec 2011 02:34:35 +0100 Subject: [PATCH] Fix use of a potentially freed net_buffer. The buffer may have been freed if its data was added to the queue, but later the buffer size was still read from the object. A spurious acknowledge may have been sent, or one would have gone missing, depending on what happened with the allocation after it was freed. --- src/add-ons/kernel/network/protocols/tcp/TCPEndpoint.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/add-ons/kernel/network/protocols/tcp/TCPEndpoint.cpp b/src/add-ons/kernel/network/protocols/tcp/TCPEndpoint.cpp index 481d4555d7..c2a37db780 100644 --- a/src/add-ons/kernel/network/protocols/tcp/TCPEndpoint.cpp +++ b/src/add-ons/kernel/network/protocols/tcp/TCPEndpoint.cpp @@ -1703,7 +1703,11 @@ TCPEndpoint::_Receive(tcp_segment_header& segment, net_buffer* buffer) bool notify = false; - if ((buffer->size > 0 || (segment.flags & TCP_FLAG_FINISH) != 0) + // The buffer may be freed if its data is added to the queue, so cache + // the size as we still need it later. + uint32 bufferSize = buffer->size; + + if ((bufferSize > 0 || (segment.flags & TCP_FLAG_FINISH) != 0) && _ShouldReceive()) notify = _AddData(segment, buffer); else { @@ -1757,7 +1761,7 @@ TCPEndpoint::_Receive(tcp_segment_header& segment, net_buffer* buffer) if (notify) _NotifyReader(); - if (buffer->size > 0 || (segment.flags & TCP_FLAG_SYNCHRONIZE) != 0) + if (bufferSize > 0 || (segment.flags & TCP_FLAG_SYNCHRONIZE) != 0) action |= ACKNOWLEDGE; _UpdateTimestamps(segment, segmentLength);