lwIP - A Lightweight TCP/IP stack - Bugs: bug #19225, bind, connect, and sendto should...
You are not allowed to post comments on this tracker with your current authentication level.
bug #19225: bind, connect, and sendto should verify input paramers
Submitter: | Dmitry Potapov <dpotapov> | ||
Submitted: | Wed 07 Mar 2007 07:36:04 AM UTC | ||
Category: | sockets/netconn | Severity: | 2 - Minor |
Item Group: | Change Request | Status: | Fixed |
Privacy: | Public | Assigned to: | fbernon |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | None |
Jump to the original submission
Wed 07 Mar 2007 01:18:49 PM UTC, comment #9: |
Dmitry Potapov <dpotapov> |
Wed 07 Mar 2007 11:09:17 AM UTC, comment #8: We're all agreed it would be nice, but I'm sure there are some people out there using the netconn API, and the risk of breaking the sockets API would be reasonably high, so this is not something I'd encourage people to spend time on.
|
Kieran Mansley <kieranm> |
Wed 07 Mar 2007 10:49:48 AM UTC, comment #7: I definitively would like to, though not today ;-)
|
Simon Goldschmidt <goldsimon> |
Wed 07 Mar 2007 10:38:00 AM UTC, comment #6: Agree with you Simon. You do the job ? :) |
Frédéric Bernon <fbernon> |
Wed 07 Mar 2007 10:34:45 AM UTC, comment #5:
|
Simon Goldschmidt <goldsimon> |
Wed 07 Mar 2007 10:13:11 AM UTC, comment #4:
|
Frédéric Bernon <fbernon> |
Wed 07 Mar 2007 09:52:31 AM UTC, comment #3: I believe that the whole socket.c is overhead that you are ready to pay for better compatibility with standard sockets. So, if you worry about footprint and performance, it is better to use netconn_ interface. And, we check the first parameter - socket descriptor, why don't have a reasonable check for others? If you think it adds big overhead, then let's make it ASSERT.
|
Dmitry Potapov <dpotapov> |
Wed 07 Mar 2007 09:21:22 AM UTC, comment #2: Don't you think this checking would have to be disable to reduce footprint and increase performance in "production time", but enable to allow a higher checking during "debug time", or if you don't manage applications using lwip (in my case, I can trust the application developer, it's me :) )?
|
Frédéric Bernon <fbernon> |
Wed 07 Mar 2007 08:57:03 AM UTC, comment #1: Is this designed to catch misbehaving applications, or to prevent applications using a feature that we don't support?
|
Kieran Mansley <kieranm> |
Wed 07 Mar 2007 07:36:04 AM UTC, original submission:
I have attached the patch, which check namelen and sin_family in the aformentioned functions
|
Dmitry Potapov <dpotapov> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 7 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2007-03-11 | fbernon | Open/Closed | Open | Closed | |
2007-03-11 | fbernon | Status | None | Fixed | |
2007-03-11 | fbernon | Assigned to | None | fbernon | |
2007-03-07 | dpotapov | Attached File | - | Added socket.patch, #12143 | |
2007-03-07 | kieranm | Severity | 3 - Normal | 2 - Minor | |
Item Group | Faulty Behaviour | Change Request | |||
2007-03-07 | dpotapov | Attached File | - | Added socket-inaddr-check.patch, #12137 |
Powered by Savane 3.13-3230.
Corresponding source code
I have prepared another patch, which adds LWIP_ASSERT in those places. Also, I have removed excessive set_errno() calls after get_socket(), because errno is set inside of get_socket().
And, yes, netconn API is mainly useful because it allows to avoid an extra copy (and extra memory too).
(file #12143)