The tcp_stream_rx() function calls store_block() to check if the destination memory region is available for the chunk of data to be copied to it. The store_block() function returns a negative value in case the destination memory region is already in use. However this return value is not checked in tcp_stream_rx(). Take the return value of store_block() into consideration.
Signed-off-by: Sughosh Ganu <sughosh.g...@linaro.org> --- net/wget.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/wget.c b/net/wget.c index 0b082c61947..847097a0e3e 100644 --- a/net/wget.c +++ b/net/wget.c @@ -227,7 +227,8 @@ static int tcp_stream_rx(struct tcp_stream *tcp, u32 rx_offs, void *buf, int len if ((max_rx_pos == (u32)(-1)) || (max_rx_pos < rx_offs + len - 1)) max_rx_pos = rx_offs + len - 1; - store_block(buf, rx_offs - http_hdr_size, len); + if (store_block(buf, rx_offs - http_hdr_size, len) < 0) + return -1; return len; } -- 2.34.1