abc/lwip
1
0
Fork 0
mirror of https://git.savannah.nongnu.org/git/lwip.git synced 2026-08-13 19:13:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #49218: pbuf_clen() overflow as a result of tcp_write concatenation

Browse Source 
Let pbuf_clen() return u16_t
This commit is contained in:
Dirk Ziegelmeier
2016-09-30 09:04:36 +02:00
parent 682b82aad8
commit 149701b347
5 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/core/ipv6/ip6_frag.c
View File

@@ -147,7 +147,7 @@ ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr)
{
struct ip6_reassdata *prev;
u16_t pbufs_freed = 0;
u8_t clen;
u16_t clen;
struct pbuf *p;
struct ip6_reass_helper *iprh;
@@ -262,7 +262,8 @@ ip6_reass(struct pbuf *p)
struct ip6_reass_helper *iprh, *iprh_tmp, *iprh_prev=NULL;
struct ip6_frag_hdr *frag_hdr;
u16_t offset, len;
u8_t clen, valid = 1;
u16_t clen;
u8_t valid = 1;
struct pbuf *q;
IP6_FRAG_STATS_INC(ip6_frag.recv);