buglwIP - A Lightweight TCP/IP stack - Bugs: bug #12591, tcp_enqueue: *queue is not set but...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #12591: tcp_enqueue: *queue is not set but tcp_segs_free'd later, if the limit TCP_SND_QUEUELEN is reached

Submitter:  None
Submitted:  Thu 07 Apr 2005 11:33:58 AM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  None

Fri 17 Nov 2006 11:45:12 AM UTC, comment #2: 

*queue in tcp_enqueue() is initialized in tcp_out.c HEAD, assuming it was fixed, but not closed in this tracker.

Christiaan Simons <christiaans>
Group Member
Wed 25 May 2005 05:15:07 AM UTC, comment #1: 

I found this same bug.  Here is a more detailed explanation.

In tcp_out.c in version 1.1.0, the system can crash when the queue is full in tcp_enqueue().  The variable "queue" is not initialized to NULL when declared, and not all systems automatically initialize local variable memory space to 0.  On systems where uninitialized variables are not zeroed, and a branch to "memerr" occurs before it is set (as when TCP_SND_QUEUELEN is reached as original author pointed out) will cause this memerr code to crash:

  if (queue != NULL) {
    tcp_segs_free(queue);
  }

because queue will be some random uninitialized garbage.

To fix the problem, initialize the queue variable to NULL.

Greg Sadosuk
-email is unavailable-

Anonymous
Thu 07 Apr 2005 11:33:58 AM UTC, original submission:  


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 2 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2006-11-17 christiaans StatusNone Fixed
    Open/ClosedOpen Closed

Back to the top

Powered by Savane 3.13-758e.
Corresponding source code