libs/rt-thread
libs
/
rt-thread
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[bug] use pointer that memory had freed. (#5971)

This commit is contained in:
xiangxistu 2022-05-23 01:46:22 +08:00 committed by GitHub
parent d738ad620c
commit 4961ed59ba
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
components/net/at/at_socket/at_socket.c
View File

@ -110,9 +110,10 @@ static int at_recvpkt_all_delete(rt_slist_t *rlist)
return 0;
}
for(node = rt_slist_first(rlist); node; node = rt_slist_next(node))
for(node = rt_slist_first(rlist); node;)
{
pkt = rt_slist_entry(node, struct at_recv_pkt, list);
node = rt_slist_next(node);
if (pkt->buff)
{
rt_free(pkt->buff);
@ -157,6 +158,7 @@ static int at_recvpkt_node_delete(rt_slist_t *rlist, rt_slist_t *node)
static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
{
rt_slist_t *node = RT_NULL;
rt_slist_t *free_node = RT_NULL;
at_recv_pkt_t pkt = RT_NULL;
size_t content_pos = 0, page_pos = 0;
@ -165,10 +167,13 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
return 0;
}
for (node = rt_slist_first(rlist); node; node = rt_slist_next(node))
for (node = rt_slist_first(rlist); node;)
{
pkt = rt_slist_entry(node, struct at_recv_pkt, list);
free_node = node;
node = rt_slist_next(node);
page_pos = pkt->bfsz_totle - pkt->bfsz_index;
if (page_pos >= len - content_pos)
@ -177,7 +182,7 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
pkt->bfsz_index += len - content_pos;
if (pkt->bfsz_index == pkt->bfsz_totle)
{
at_recvpkt_node_delete(rlist, node);
at_recvpkt_node_delete(rlist, free_node);
}
content_pos = len;
break;
@ -187,7 +192,7 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
rt_memcpy((char *) mem + content_pos, pkt->buff + pkt->bfsz_index, page_pos);
content_pos += page_pos;
pkt->bfsz_index += page_pos;
at_recvpkt_node_delete(rlist, node);
at_recvpkt_node_delete(rlist, free_node);
}
}