From: Curtis Larsen <larsen@dixie.edu>
Date: Sun, 7 Dec 2014 08:28:57 +0000 (+0300)
Subject: fix double free in grub_net_recv_tcp_packet
X-Git-Tag: 2.02-beta3~591
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=06eadf5ebf21c8520d696c6438a976e5f7c218c3;p=thirdparty%2Fgrub.git

fix double free in grub_net_recv_tcp_packet

Using the http module to download config files, produces memory errors,
after the config file is downloaded.

The error was traced to the tcp stack in grub-core/net/tcp.c. The wrong
netbuff pointer was being freed in the clean up loop.

Changing the code to free the correct netbuff pointer removes the runtime
error.

Closes 42765.
---

diff --git a/ChangeLog b/ChangeLog
index a9ed5aa46..e5c9fd346 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2014-12-07  Curtis Larsen <larsen@dixie.edu>
+
+	* grub-core/net/tcp.c (grub_net_recv_tcp_packet): Fix double
+	free when multiple empty segments were received (closes 42765).
+
 2014-12-05  Andrei Borzenkov  <arvidjaar@gmail.com>
 
 	* tests/util/grub-shell.in: Support --files also for netboot.
diff --git a/grub-core/net/tcp.c b/grub-core/net/tcp.c
index 2077f5519..1d90f1ec5 100644
--- a/grub-core/net/tcp.c
+++ b/grub-core/net/tcp.c
@@ -918,7 +918,7 @@ grub_net_recv_tcp_packet (struct grub_net_buff *nb,
 	      do_ack = 1;
 	    }
 	  else
-	    grub_netbuff_free (nb);
+	    grub_netbuff_free (nb_top);
 	}
       if (do_ack)
 	ack (sock);