set pkt_len to zero after free

2 files changed, 3 insertions, 1 deletions

diff --git a/src/pkt.c b/src/pkt.c
index e2fd2a8..beb6291 100644
--- a/src/pkt.c
+++ b/src/pkt.c
@@ -467,6 +467,7 @@ void handle_ack(uint16_t seq_no, icmp_desc_t ring[], int *packets_awaiting_ack,
 					*remote_ack	= (uint16_t)ntohl(pt_pkt->ack);
 					free(ring[i].pkt);
 					ring[i].pkt	= 0;
+					ring[i].pkt_len	= 0;
 					(*packets_awaiting_ack)--;
 					if (i == *first_ack) {
 						for (j=1;j<window_size;j++) {
@@ -504,6 +505,7 @@ void handle_ack(uint16_t seq_no, icmp_desc_t ring[], int *packets_awaiting_ack,
 				if (can_ack) {
 					free(ring[i].pkt);
 					ring[i].pkt	= 0;
+					ring[i].pkt_len	= 0;
 					(*packets_awaiting_ack)--;
 				}
 				i--;
diff --git a/src/ptunnel.c b/src/ptunnel.c
index 87dcc39..fad0944 100644
--- a/src/ptunnel.c
+++ b/src/ptunnel.c
@@ -668,7 +668,7 @@ void* pt_proxy(void *args) {
 				             cur->dst_ip, cur->dst_port, kProto_ack | cur->type_flag,
 				             &cur->dest_addr, cur->next_remote_seq, &cur->send_first_ack, &cur->ping_seq, cur->window_size);
 				cur->xfer.icmp_ack_out++;
-				if (cur->send_ring[idx].pkt && cur->send_ring[idx].pkt->type == kICMP_echo_request) {
+				if (cur->send_ring[idx].pkt_len > sizeof(icmp_echo_packet_t) && cur->send_ring[idx].pkt->type == kICMP_echo_request) {
 					for (uint16_t e = 0; e < opts.empty_pings; e++) {
 						cur->send_ring[idx].pkt->seq      = htons(cur->ping_seq);
 						cur->ping_seq++;