Comment # 33
on bug 8111
from Martin Kaiser
(In reply to comment #23)
> Created attachment 9744 [details]
> Sanity checks in fragment_set_tot_len
>
> These sanity checks also prevent the crash, although I'm not sure if they
> are perhaps overly strict?
in your patch, fd_head should be checked for NULL before it's dereferenced.
This case happens e.g. when fragment_set_tot_len() is called before
fragment_add() - like I suggested for DTLS. The order of these calls should be
changed back such that fragment_add() comes before fragment_set_tot_len().
Setting a length has no effect when no fragment was added for the given id.
The attached patch reverts my previous workaround and adds a NULL check to your
patch. This seems to fix #8111 and #8163.
You are receiving this mail because:
- You are watching all bug changes.