[bug] use pointer that memory had freed.
@@ -110,9 +110,10 @@ static int at_recvpkt_all_delete(rt_slist_t *rlist)
return 0;
}
- for(node = rt_slist_first(rlist); node; node = rt_slist_next(node))
+ for(node = rt_slist_first(rlist); node;)
{
pkt = rt_slist_entry(node, struct at_recv_pkt, list);
+ node = rt_slist_next(node);
if (pkt->buff)
{
rt_free(pkt->buff);
@@ -157,6 +158,7 @@ static int at_recvpkt_node_delete(rt_slist_t *rlist, rt_slist_t *node)
static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
{
rt_slist_t *node = RT_NULL;
+ rt_slist_t *free_node = RT_NULL;
at_recv_pkt_t pkt = RT_NULL;
size_t content_pos = 0, page_pos = 0;
@@ -165,10 +167,13 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
return 0;
}
- for (node = rt_slist_first(rlist); node; node = rt_slist_next(node))
+ for (node = rt_slist_first(rlist); node;)
{
pkt = rt_slist_entry(node, struct at_recv_pkt, list);
+ free_node = node;
+ node = rt_slist_next(node);
+
page_pos = pkt->bfsz_totle - pkt->bfsz_index;
if (page_pos >= len - content_pos)
@@ -177,7 +182,7 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
pkt->bfsz_index += len - content_pos;
if (pkt->bfsz_index == pkt->bfsz_totle)
{
- at_recvpkt_node_delete(rlist, node);
+ at_recvpkt_node_delete(rlist, free_node);
}
content_pos = len;
break;
@@ -187,7 +192,7 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
rt_memcpy((char *) mem + content_pos, pkt->buff + pkt->bfsz_index, page_pos);
content_pos += page_pos;
pkt->bfsz_index += page_pos;
- at_recvpkt_node_delete(rlist, node);
+ at_recvpkt_node_delete(rlist, free_node);
}
}
