From 63ae3b367ae505ca41ef4b8cb4449b4396706bac Mon Sep 17 00:00:00 2001 From: Jose Alamos Date: Mon, 29 Jan 2024 14:34:41 +0100 Subject: [PATCH] gnrc_ipv6: fix double free when pinging TNT loopback address (cherry picked from commit 8dc5e9109ea405c7c0898582f5c01584cacec748) --- sys/net/gnrc/network_layer/ipv6/gnrc_ipv6.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/sys/net/gnrc/network_layer/ipv6/gnrc_ipv6.c b/sys/net/gnrc/network_layer/ipv6/gnrc_ipv6.c index 382d2fcc6a67..fc733ca0d3cb 100644 --- a/sys/net/gnrc/network_layer/ipv6/gnrc_ipv6.c +++ b/sys/net/gnrc/network_layer/ipv6/gnrc_ipv6.c @@ -634,9 +634,13 @@ static void _send_multicast(gnrc_pktsnip_t *pkt, bool prep_hdr, static void _send_to_self(gnrc_pktsnip_t *pkt, bool prep_hdr, gnrc_netif_t *netif) { - if (!_safe_fill_ipv6_hdr(netif, pkt, prep_hdr) || - /* no netif header so we just merge the whole packet. */ - (gnrc_pktbuf_merge(pkt) != 0)) { + /* _safe_fill_ipv6_hdr releases pkt on error */ + if (!_safe_fill_ipv6_hdr(netif, pkt, prep_hdr)) { + DEBUG("ipv6: error looping packet to sender.\n"); + return; + } + /* no netif header so we just merge the whole packet. */ + else if (gnrc_pktbuf_merge(pkt) != 0) { DEBUG("ipv6: error looping packet to sender.\n"); gnrc_pktbuf_release(pkt); return;