Unverified Commit 1231317c authored by Dryw Wade's avatar Dryw Wade Committed by GitHub

Fix race condition between WiFi receive and consume (#1614)

If another packet comes in between freeing `_rx_buf` and setting `_rx_buf` to 0, that new packet could get put into the same memory address and get concatenated to itself, which leads to an infinite loop.
New solution assigns a temp pointer, sets `rx_buf` to 0, then frees the memory, which guarantees `_rx_buf` always points to valid data.
parent cd76f030
...@@ -611,9 +611,10 @@ protected: ...@@ -611,9 +611,10 @@ protected:
_rx_buf_offset += size; _rx_buf_offset += size;
} else if (!_rx_buf->next) { } else if (!_rx_buf->next) {
DEBUGV(":c0 %d, %d\r\n", size, _rx_buf->tot_len); DEBUGV(":c0 %d, %d\r\n", size, _rx_buf->tot_len);
pbuf_free(_rx_buf); auto head = _rx_buf;
_rx_buf = 0; _rx_buf = 0;
_rx_buf_offset = 0; _rx_buf_offset = 0;
pbuf_free(head);
} else { } else {
DEBUGV(":c %d, %d, %d\r\n", size, _rx_buf->len, _rx_buf->tot_len); DEBUGV(":c %d, %d, %d\r\n", size, _rx_buf->len, _rx_buf->tot_len);
auto head = _rx_buf; auto head = _rx_buf;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment