[lwip-users] tcp_receive bugfix - incoming segment is larger than the old segment.

[Oleg Tychev]

Hello, All!

I see on this code fragment in function tcp_receive
             if (inseg.len > next->len) {
               /* The incoming segment is larger than the old
                  segment. We replace the old segment with the new
                  one. */
               cseg = tcp_seg_copy(&inseg);
               if (cseg != NULL) {
                 cseg->next = next->next;
                 if (prev != NULL) {
                   prev->next = cseg;
                 } else {
                   pcb->ooseq = cseg;
                 }
               }
               break;
             } else {
and think it should have free function for "next"

             if (inseg.len > next->len) {
               /* The incoming segment is larger than the old
                  segment. We replace the old segment with the new
                  one. */
               cseg = tcp_seg_copy(&inseg);
               if (cseg != NULL) {
                 cseg->next = next->next;
                 tcp_seg_free(next);
                 if (prev != NULL) {
                   prev->next = cseg;
                 } else {
                   pcb->ooseq = cseg;
                 }
               }
               break;
             } else {

Poka poka
-------------
Oleg Tychev