fix double free in grub_net_recv_tcp_packet

Using the http module to download config files, produces memory errors,
after the config file is downloaded.

The error was traced to the tcp stack in grub-core/net/tcp.c. The wrong
netbuff pointer was being freed in the clean up loop.

Changing the code to free the correct netbuff pointer removes the runtime
error.

Closes 42765.

diff --git a/ChangeLog b/ChangeLog
index a9ed5aa46f972c6952d9039c15b16cc0856f5408..e5c9fd3462a25e098462ccf7af22eedbad4f86c0 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2014-12-07  Curtis Larsen <larsen@dixie.edu>
+
+       * grub-core/net/tcp.c (grub_net_recv_tcp_packet): Fix double
+       free when multiple empty segments were received (closes 42765).
+
 2014-12-05  Andrei Borzenkov  <arvidjaar@gmail.com>
 
        * tests/util/grub-shell.in: Support --files also for netboot.

diff --git a/grub-core/net/tcp.c b/grub-core/net/tcp.c
index 2077f5519b278b5fcb1e35b13ec30a14c29d7720..1d90f1ec5d0cec9595a09549aeeefe6fa29a5202 100644 (file)
--- a/grub-core/net/tcp.c
+++ b/grub-core/net/tcp.c
@@ -918,7 +918,7 @@ grub_net_recv_tcp_packet (struct grub_net_buff *nb,
              do_ack = 1;
            }
          else
-           grub_netbuff_free (nb);
+           grub_netbuff_free (nb_top);
        }
       if (do_ack)
        ack (sock);