Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

mdsn: fix race condition in updating packet data from user task when failed to allocate or queue a new service

Browse source 
Issue: mdns_service_add API allocates and queues an action to be processed in mdns task context; when allocation or queueing fails, allocated structure needs to be freed. Function _mdns_free_service did not only fee all the structures, but also updates packet data.
Resolution: Moved removal of packet data outside of _mdns_free_service function.
This commit is contained in:
David Cermak 2019-03-01 16:59:38 +01:00
parent 03006a109b
commit f8310c4a67
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
components/mdns/mdns.c
View file

@ -1848,6 +1848,9 @@ static void _mdns_dealloc_scheduled_service_answers(mdns_out_answer_t ** destina
*/
static void _mdns_remove_scheduled_service_packets(mdns_service_t * service)
{
if (!service) {
return;
}
mdns_tx_packet_t * p = NULL;
mdns_tx_packet_t * q = _mdns_server->tx_queue_head;
while (q) {
@ -1936,7 +1939,6 @@ static void _mdns_free_service(mdns_service_t * service)
if (!service) {
return;
}
_mdns_remove_scheduled_service_packets(service);
free((char *)service->instance);
free((char *)service->service);
free((char *)service->proto);
@ -3763,6 +3765,7 @@ static void _mdns_execute_action(mdns_action_t * action)
if (_mdns_server->services == action->data.srv_del.service) {
_mdns_server->services = a->next;
_mdns_send_bye(&a, 1, false);
_mdns_remove_scheduled_service_packets(a->service);
_mdns_free_service(a->service);
free(a);
} else {
@ -3773,6 +3776,7 @@ static void _mdns_execute_action(mdns_action_t * action)
mdns_srv_item_t * b = a->next;
a->next = a->next->next;
_mdns_send_bye(&b, 1, false);
_mdns_remove_scheduled_service_packets(b->service);
_mdns_free_service(b->service);
free(b);
}
@ -3786,6 +3790,7 @@ static void _mdns_execute_action(mdns_action_t * action)
while (a) {
mdns_srv_item_t * s = a;
a = a->next;
_mdns_remove_scheduled_service_packets(s->service);
_mdns_free_service(s->service);
free(s);
}