[lwip-devel] [bug #47805] dhcp_recv can dereference NULL pointer

[Jan Breuer]

URL:
  <http://savannah.nongnu.org/bugs/?47805>

                 Summary: dhcp_recv can dereference NULL pointer
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: jan_breuer
            Submitted on: Fri 29 Apr 2016 09:04:35 AM GMT
                Category: DHCP
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 
            lwIP version: git head

    _______________________________________________________

Details:

In dhcp_recv function there is 

if ((dhcp == NULL) || ...) goto free_pbuf_and_return;

but in free_pbuf_and_return there is

dhcp->msg_in = NULL;

which is possibly dereferencing NULL pointer.




    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?47805>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/