From 9521f54741a3a9ec117688604c1eb7fa777f83c1 Mon Sep 17 00:00:00 2001
From: goldsimon <goldsimon>
Date: Thu, 14 Jan 2010 15:43:11 +0000
Subject: [PATCH] Another fix for bug #28562: Segfault @ err_tcp

---
 src/api/api_msg.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/api/api_msg.c b/src/api/api_msg.c
index 3344fedf..bc432203 100644
--- a/src/api/api_msg.c
+++ b/src/api/api_msg.c
@@ -619,7 +619,10 @@ netconn_drain(struct netconn *conn)
       if (conn->type == NETCONN_TCP) {
         if(mem != NULL) {
           p = (struct pbuf*)mem;
-          tcp_recved(conn->pcb.tcp, p->tot_len);
+          /* pcb might be set to NULL already by err_tcp() */
+          if (conn->pcb.tcp != NULL) {
+            tcp_recved(conn->pcb.tcp, p->tot_len);
+          }
           pbuf_free(p);
         }
       } else {
@@ -634,7 +637,11 @@ netconn_drain(struct netconn *conn)
   conn->acceptmbox = SYS_MBOX_NULL;
   if (mbox != SYS_MBOX_NULL) {
     while (sys_mbox_tryfetch(mbox, &mem) != SYS_MBOX_EMPTY) {
-      tcp_accepted(conn->pcb.tcp);
+      /* Only tcp pcbs have an acceptmbox, so no need to check conn->type */
+      /* pcb might be set to NULL already by err_tcp() */
+      if (conn->pcb.tcp != NULL) {
+        tcp_accepted(conn->pcb.tcp);
+      }
       netconn_delete((struct netconn *)mem);
     }
     sys_mbox_free(mbox);