From 244d7f8da2a9b84587c74f4bfd5f14dfd48485ff Mon Sep 17 00:00:00 2001 From: liuxianliang Date: Thu, 19 May 2022 17:45:10 +0800 Subject: [PATCH] [bug] use pointer that memory had freed. --- components/net/at/at_socket/at_socket.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/components/net/at/at_socket/at_socket.c b/components/net/at/at_socket/at_socket.c index 4a44245b489..cf15b590e06 100644 --- a/components/net/at/at_socket/at_socket.c +++ b/components/net/at/at_socket/at_socket.c @@ -110,9 +110,10 @@ static int at_recvpkt_all_delete(rt_slist_t *rlist) return 0; } - for(node = rt_slist_first(rlist); node; node = rt_slist_next(node)) + for(node = rt_slist_first(rlist); node;) { pkt = rt_slist_entry(node, struct at_recv_pkt, list); + node = rt_slist_next(node); if (pkt->buff) { rt_free(pkt->buff); @@ -157,6 +158,7 @@ static int at_recvpkt_node_delete(rt_slist_t *rlist, rt_slist_t *node) static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len) { rt_slist_t *node = RT_NULL; + rt_slist_t *free_node = RT_NULL; at_recv_pkt_t pkt = RT_NULL; size_t content_pos = 0, page_pos = 0; @@ -165,10 +167,13 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len) return 0; } - for (node = rt_slist_first(rlist); node; node = rt_slist_next(node)) + for (node = rt_slist_first(rlist); node;) { pkt = rt_slist_entry(node, struct at_recv_pkt, list); + free_node = node; + node = rt_slist_next(node); + page_pos = pkt->bfsz_totle - pkt->bfsz_index; if (page_pos >= len - content_pos) @@ -177,7 +182,7 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len) pkt->bfsz_index += len - content_pos; if (pkt->bfsz_index == pkt->bfsz_totle) { - at_recvpkt_node_delete(rlist, node); + at_recvpkt_node_delete(rlist, free_node); } content_pos = len; break; @@ -187,7 +192,7 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len) rt_memcpy((char *) mem + content_pos, pkt->buff + pkt->bfsz_index, page_pos); content_pos += page_pos; pkt->bfsz_index += page_pos; - at_recvpkt_node_delete(rlist, node); + at_recvpkt_node_delete(rlist, free_node); } }