buglwIP - A Lightweight TCP/IP stack - Bugs: bug #20480, tcp_listen should check the pcb

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #20480: tcp_listen should check the pcb

Submitter:  Simon Goldschmidt <goldsimon>
Submitted:  Sat 14 Jul 2007 09:58:41 AM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  None

Tue 24 Jul 2007 07:43:15 AM UTC, comment #4: 

Fixed with an LWIP_ERROR in tcp.c:tcp_listen and a check in api_msg.c:do_listen (to set the correct error value): pcb->state is checked to be CLOSED.

Simon Goldschmidt <goldsimon>
Group administrator
Sat 14 Jul 2007 04:45:34 PM UTC, comment #3: 


> I think we should plan that for 1.3.0, right?


Yes.

And the LWIP_ERROR seems OK to me. Also we could add a check (maybe also with LWIP_ERROR) in the netconn API so we don't set conn->err to ERR_MEM if tcp_listen fails because of the wrong state. I'll do that as soon as I have time, it's no big change after all.

Simon Goldschmidt <goldsimon>
Group administrator
Sat 14 Jul 2007 02:52:24 PM UTC, comment #2: 

I think we should plan that for 1.3.0, right?

Frédéric Bernon <fbernon>
Group Member
Sat 14 Jul 2007 02:34:09 PM UTC, comment #1: 

Even if it doesn't seem to be a legitimate behavior, it's ok for me to add this check... I think the check should be done in a LWIP_ERROR, since it depend of the confiance each one have in his application developers...

Frédéric Bernon <fbernon>
Group Member
Sat 14 Jul 2007 09:58:41 AM UTC, original submission:  

if tcp_listen is passed a tcp_pcb that is not in state closed (so, not on tcp_bound_pcbs but on another list), this pcb will be freed and stays on the list that is is on.

e.g. you can call tcp_listen with a tcp_pcb that is currently connected, tcp_listen will try to remove that from the tcp_bound_pcbs list (which it is not on) and free it. Then, if the pcb_active_pcbs is scanned again later, there will be an entry in it which is freed.

Possible solution: check that the pcb given to tcp_listen is in state CLOSED

Simon Goldschmidt <goldsimon>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by fbernon (Posted a comment)
  • -email is unavailable- added by goldsimon (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-07-24 goldsimon StatusNone Fixed
        Open/ClosedOpen Closed
    2007-07-14 goldsimon Assigned toNone goldsimon
        Planned Release 1.3.0

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code