未验证 提交 4961ed59 编写于 作者: X xiangxistu 提交者: GitHub

[bug] use pointer that memory had freed. (#5971)

上级 d738ad62
......@@ -110,9 +110,10 @@ static int at_recvpkt_all_delete(rt_slist_t *rlist)
return 0;
}
for(node = rt_slist_first(rlist); node; node = rt_slist_next(node))
for(node = rt_slist_first(rlist); node;)
{
pkt = rt_slist_entry(node, struct at_recv_pkt, list);
node = rt_slist_next(node);
if (pkt->buff)
{
rt_free(pkt->buff);
......@@ -157,6 +158,7 @@ static int at_recvpkt_node_delete(rt_slist_t *rlist, rt_slist_t *node)
static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
{
rt_slist_t *node = RT_NULL;
rt_slist_t *free_node = RT_NULL;
at_recv_pkt_t pkt = RT_NULL;
size_t content_pos = 0, page_pos = 0;
......@@ -165,10 +167,13 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
return 0;
}
for (node = rt_slist_first(rlist); node; node = rt_slist_next(node))
for (node = rt_slist_first(rlist); node;)
{
pkt = rt_slist_entry(node, struct at_recv_pkt, list);
free_node = node;
node = rt_slist_next(node);
page_pos = pkt->bfsz_totle - pkt->bfsz_index;
if (page_pos >= len - content_pos)
......@@ -177,7 +182,7 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
pkt->bfsz_index += len - content_pos;
if (pkt->bfsz_index == pkt->bfsz_totle)
{
at_recvpkt_node_delete(rlist, node);
at_recvpkt_node_delete(rlist, free_node);
}
content_pos = len;
break;
......@@ -187,7 +192,7 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
rt_memcpy((char *) mem + content_pos, pkt->buff + pkt->bfsz_index, page_pos);
content_pos += page_pos;
pkt->bfsz_index += page_pos;
at_recvpkt_node_delete(rlist, node);
at_recvpkt_node_delete(rlist, free_node);
}
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册