kopia lustrzana https://github.com/espressif/esp-idf
mdsn: fix race condition in updating packet data from user task when failed to allocate or queue a new service
Issue: mdns_service_add API allocates and queues an action to be processed in mdns task context; when allocation or queueing fails, allocated structure needs to be freed. Function _mdns_free_service did not only fee all the structures, but also updates packet data. Resolution: Moved removal of packet data outside of _mdns_free_service function.pull/3137/head
rodzic
67051a286b
commit
021dc5d453
|
@ -1863,6 +1863,9 @@ static void _mdns_dealloc_scheduled_service_answers(mdns_out_answer_t ** destina
|
||||||
*/
|
*/
|
||||||
static void _mdns_remove_scheduled_service_packets(mdns_service_t * service)
|
static void _mdns_remove_scheduled_service_packets(mdns_service_t * service)
|
||||||
{
|
{
|
||||||
|
if (!service) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
mdns_tx_packet_t * p = NULL;
|
mdns_tx_packet_t * p = NULL;
|
||||||
mdns_tx_packet_t * q = _mdns_server->tx_queue_head;
|
mdns_tx_packet_t * q = _mdns_server->tx_queue_head;
|
||||||
while (q) {
|
while (q) {
|
||||||
|
@ -1951,7 +1954,6 @@ static void _mdns_free_service(mdns_service_t * service)
|
||||||
if (!service) {
|
if (!service) {
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
_mdns_remove_scheduled_service_packets(service);
|
|
||||||
free((char *)service->instance);
|
free((char *)service->instance);
|
||||||
free((char *)service->service);
|
free((char *)service->service);
|
||||||
free((char *)service->proto);
|
free((char *)service->proto);
|
||||||
|
@ -3781,6 +3783,7 @@ static void _mdns_execute_action(mdns_action_t * action)
|
||||||
if (_mdns_server->services == action->data.srv_del.service) {
|
if (_mdns_server->services == action->data.srv_del.service) {
|
||||||
_mdns_server->services = a->next;
|
_mdns_server->services = a->next;
|
||||||
_mdns_send_bye(&a, 1, false);
|
_mdns_send_bye(&a, 1, false);
|
||||||
|
_mdns_remove_scheduled_service_packets(a->service);
|
||||||
_mdns_free_service(a->service);
|
_mdns_free_service(a->service);
|
||||||
free(a);
|
free(a);
|
||||||
} else {
|
} else {
|
||||||
|
@ -3791,6 +3794,7 @@ static void _mdns_execute_action(mdns_action_t * action)
|
||||||
mdns_srv_item_t * b = a->next;
|
mdns_srv_item_t * b = a->next;
|
||||||
a->next = a->next->next;
|
a->next = a->next->next;
|
||||||
_mdns_send_bye(&b, 1, false);
|
_mdns_send_bye(&b, 1, false);
|
||||||
|
_mdns_remove_scheduled_service_packets(b->service);
|
||||||
_mdns_free_service(b->service);
|
_mdns_free_service(b->service);
|
||||||
free(b);
|
free(b);
|
||||||
}
|
}
|
||||||
|
@ -3804,6 +3808,7 @@ static void _mdns_execute_action(mdns_action_t * action)
|
||||||
while (a) {
|
while (a) {
|
||||||
mdns_srv_item_t * s = a;
|
mdns_srv_item_t * s = a;
|
||||||
a = a->next;
|
a = a->next;
|
||||||
|
_mdns_remove_scheduled_service_packets(s->service);
|
||||||
_mdns_free_service(s->service);
|
_mdns_free_service(s->service);
|
||||||
free(s);
|
free(s);
|
||||||
}
|
}
|
||||||
|
|
Ładowanie…
Reference in New Issue