[lwip-devel] sys_check_timeouts() can access NULL pointer?

[narke]

Hi,

In the sys_check_timeouts() function:

   ...
    do
    {
      had_one = 0;
      tmptimeout = next_timeout;
      if (tmptimeout->time <= diff) {
        /* timeout has expired */
        had_one = 1;
        timeouts_last_time = now;
        diff -= tmptimeout->time;
        next_timeout = tmptimeout->next;
        ....

      }
    /* repeat until all expired timers have been called */
    }while(had_one);
    ...

tmptimeout each round in the loop will be assigned next_timeout which
in turn could be NULL if it is the last timer in the list. So the
  if (tmptimeout->time <= diff)
statement will refer a NULL pointer.

The only situation I can imaged in which it works is that: every timer
has to start another timer when it's handler get called.  Is my
understanding right?

Thanks in advance.

-- 
Life is the only flaw in an otherwise perfect nonexistence
    -- Schopenhauer

narke
public key at http://subkeys.pgp.net:11371 (address@hidden)