STABLE14-rx-preparesendpacket-avoid-double-free-20061205

wow, this is special

existed forever but only when we stopped leaking packets did it become a problem

anyway, don't free packets and forget to reduce the number of packets in play

(cherry picked from commit 112604e9c31cba4f9605b6b53918aafa8cac77d0)

diff --git a/src/rx/rx_packet.c b/src/rx/rx_packet.c
index 36be01f012d03a288a42043b1b694cd3eb26a1dd..9153f30d025ce54a120453229b359ece91c7f7d9 100644 (file)
--- a/src/rx/rx_packet.c
+++ b/src/rx/rx_packet.c
@@ -2606,7 +2606,7 @@ rxi_PrepareSendPacket(register struct rx_call *call,
        osi_Panic("PrepareSendPacket 1\n");     /* MTUXXX */
     } else {
         struct rx_queue q;
-       int nb;
+       int nb;
 
        queue_Init(&q);
 
@@ -2617,8 +2617,8 @@ rxi_PrepareSendPacket(register struct rx_call *call,
        if (nb)
            rxi_FreePackets(nb, &q);
 
-       p->niovecs = i;
-       p->wirevec[i - 1].iov_len += len;
+       p->niovecs = MAX(2, i);
+       p->wirevec[MAX(2, i) - 1].iov_len += len;
     }
     RXS_PreparePacket(conn->securityObject, call, p);
 }