Skip to content

Commit 97c6772

Browse files
committed
Fix use-after-free in tcp_error
When tcp_error is called, the pcb has already been freed by LwIP. Remove the attempt to write through the invalidated pointer.
1 parent f2ec361 commit 97c6772

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

src/AsyncTCP.cpp

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -484,7 +484,8 @@ void AsyncTCP_detail::tcp_error(void *arg, int8_t err) {
484484
// ets_printf("+E: 0x%08x\n", arg);
485485
AsyncClient *client = reinterpret_cast<AsyncClient *>(arg);
486486
if (client && client->_pcb) {
487-
_reset_tcp_callbacks(client->_pcb, client);
487+
// The pcb has already been freed by LwIP; do not attempt to clear the callbacks!
488+
_remove_events_for_client(client);
488489
client->_pcb = nullptr;
489490
}
490491

0 commit comments

Comments
 (0)