prvTransferConnect()
, if the socket cannot be created the return value xResult
is set to an error code. However, the return value from prvTransferConnect()
is treated as boolean by all callers of that function. This results in a NULL pointer dereference when pxClient->xTransferSocket
is used later on. Example: in the handling of ECMD_PASV
in prvProcessCommand()
.
Fix: Function prvTransferConnect()
, line 901: Change -pdFREERTOS_ERRNO_ENOMEM
to pdFALSE
.