From 83a53449f11a609b29197e585778c1124372d106 Mon Sep 17 00:00:00 2001
From: patacongo <patacongo@42af7a65-404d-4744-a932-0658087f49c3>
Date: Wed, 16 Sep 2009 16:28:53 +0000
Subject: [PATCH] Reference count must be zero before calling uip_tcpfree()

git-svn-id: svn://svn.code.sf.net/p/nuttx/code/trunk@2065 42af7a65-404d-4744-a932-0658087f49c3
---
 net/uip/uip_tcpbacklog.c | 1 +
 net/uip/uip_tcpinput.c   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/net/uip/uip_tcpbacklog.c b/net/uip/uip_tcpbacklog.c
index 7e2b6ede4e..0abfe3061b 100644
--- a/net/uip/uip_tcpbacklog.c
+++ b/net/uip/uip_tcpbacklog.c
@@ -196,6 +196,7 @@ int uip_backlogdestroy(FAR struct uip_conn *conn)
 
                blconn->blparent = NULL;
                blconn->backlog  = NULL;
+               blconn->crefs    = 0;
                uip_tcpfree(blconn);
              }
          }
diff --git a/net/uip/uip_tcpinput.c b/net/uip/uip_tcpinput.c
index 5f0430ed26..e09cc62864 100644
--- a/net/uip/uip_tcpinput.c
+++ b/net/uip/uip_tcpinput.c
@@ -173,6 +173,7 @@ void uip_tcpinput(struct uip_driver_s *dev)
                 {
                   /* No, then we have to give the connection back */
 
+                  conn->crefs     = 0;
                   uip_tcpfree(conn);
                   conn = NULL;
                 }