Fixes for networking and tiny webserver from Max

libc/wqueue/work_thread.c

@@ -148,6 +148,15 @@ static void work_process(FAR struct wqueue_s *wqueue)
            */
 
           worker = work->worker;
+
+          /* Check for a race condition where the work may be nullified
+           * before it is removed from the queue.
+           */
+
+          if (worker != NULL)
+            {
+              /* Extract the work argument (before re-enabling interrupts) */
+
               arg = work->arg;
 
               /* Mark the work as no longer being queued */
@@ -169,6 +178,15 @@ static void work_process(FAR struct wqueue_s *wqueue)
               flags = irqsave();
               work  = (FAR struct work_s *)wqueue->q.head;
             }
+          else
+            {
+              /* Cancelled.. Just move to the next work in the list with
+               * interrupts still disabled.
+               */
+
+              work = (FAR struct work_s *)work->dq.flink;
+            }
+        }
       else
         {
           /* This one is not ready.. will it be ready before the next

net/socket/net_sendfile.c

@@ -60,10 +60,12 @@
 #include <nuttx/fs/fs.h>
 #include <nuttx/net/arp.h>
 #include <nuttx/net/netdev.h>
+#include <nuttx/net/tcp.h>
 
 #include "socket/socket.h"
 #include "netdev/netdev.h"
 #include "devif/devif.h"
+#include "tcp/tcp.h"
 
 /****************************************************************************
  * Definitions

net/utils/net_chksum.c

@@ -126,6 +126,13 @@ static uint16_t upper_layer_chksum(FAR struct net_driver_s *dev, uint8_t proto)
   upper_layer_len = (((uint16_t)(pbuf->len[0]) << 8) + pbuf->len[1]) - UIP_IPH_LEN;
 #endif /* CONFIG_NET_IPv6 */
 
+  /* Verify some minimal assumptions */
+
+  if (upper_layer_len > CONFIG_NET_BUFSIZE)
+    {
+      return 0;
+    }
+
   /* First sum pseudo-header. */
 
   /* IP protocol and length fields. This addition cannot carry. */