The tcp_stream_rx() function calls store_block() to check if the
destination memory region is available for the chunk of data to be
copied to it. The store_block() function returns a negative value in
case the destination memory region is already in use. However this
return value is not checked in tcp_stream_rx(). Take the return value
of store_block() into consideration.

Signed-off-by: Sughosh Ganu <sughosh.g...@linaro.org>
---
 net/wget.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/wget.c b/net/wget.c
index 0b082c61947..847097a0e3e 100644
--- a/net/wget.c
+++ b/net/wget.c
@@ -227,7 +227,8 @@ static int tcp_stream_rx(struct tcp_stream *tcp, u32 
rx_offs, void *buf, int len
        if ((max_rx_pos == (u32)(-1)) || (max_rx_pos < rx_offs + len - 1))
                max_rx_pos = rx_offs + len - 1;
 
-       store_block(buf, rx_offs - http_hdr_size, len);
+       if (store_block(buf, rx_offs - http_hdr_size, len) < 0)
+               return -1;
 
        return len;
 }
-- 
2.34.1

Reply via email to