* tcp_in.c: Fix for bug #23693 as suggested by Art R. Ensure cseg is unused

if tcp_seg_copy fails.

CHANGELOG

@@ -35,6 +35,11 @@ HISTORY
 
 
   ++ Bugfixes:
+
+  2008-06-24 Jonathan Larmour
+  * tcp_in.c: Fix for bug #23693 as suggested by Art R. Ensure cseg is unused
+    if tcp_seg_copy fails.
+
   2008-06-17 Simon Goldschmidt
   * inet_chksum.c: Checked in some ideas of patch #6460 (loop optimizations)
     and created defines for swapping bytes and folding u32 to u16.

src/core/tcp_in.c

@@ -1195,14 +1195,14 @@ tcp_receive(struct tcp_pcb *pcb)
                   } else {
                     pcb->ooseq = cseg;
                   }
-                }
-                tcp_seg_free(next);
-                if (cseg->next != NULL) {
-                  next = cseg->next;
-                  if (TCP_SEQ_GT(seqno + cseg->len, next->tcphdr->seqno)) {
-                    /* We need to trim the incoming segment. */
-                    cseg->len = (u16_t)(next->tcphdr->seqno - seqno);
-                    pbuf_realloc(cseg->p, cseg->len);
+                  tcp_seg_free(next);
+                  if (cseg->next != NULL) {
+                    next = cseg->next;
+                    if (TCP_SEQ_GT(seqno + cseg->len, next->tcphdr->seqno)) {
+                      /* We need to trim the incoming segment. */
+                      cseg->len = (u16_t)(next->tcphdr->seqno - seqno);
+                      pbuf_realloc(cseg->p, cseg->len);
+                    }
                   }
                 }
                 break;