buglwIP - A Lightweight TCP/IP stack - Bugs: bug #21075, pbuf_realloc() use with PBUF_RAM...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #21075: pbuf_realloc() use with PBUF_RAM and MEM_LIBC_MALLOC fails

Submitter:  Bill Florac <bflorac>
Submitted:  Fri 14 Sep 2007 08:37:02 AM UTC
   
 
Category:  pbufs Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  fbernon
Open/Closed:  Closed Planned Release:  None
lwIP version:  None

Sat 15 Sep 2007 07:36:43 AM UTC, comment #4: 

ok for Bill, so, I close it...

Frédéric Bernon <fbernon>
Group Member
Sat 15 Sep 2007 06:59:08 AM UTC, comment #3: 

Ok, I have chat with Bill, and it's "better than nothing!". So, I check in the patch. Bill, can I close it ?

Frédéric Bernon <fbernon>
Group Member
Fri 14 Sep 2007 10:38:54 AM UTC, comment #2: 


> So, I think the simplest thing to do is to replace in mem.h, line 68:
> #define mem_realloc(x, size) realloc(x,size)
> by
> #define mem_realloc(mem, size) (mem)


I also think that's the best idea, since I don't think it's performant to really use realloc() just to shrink a pbuf's payload size.

Also, I'm not sure this would really work, using realloc()  might need some modifications on the whole core code so that a payload pointer is not being saved... And since MEM_LIBC_MALLOC was originally only a workaroung for the broken mem_malloc(), I think that defining mem_realloc to doing nothing is best.

Simon Goldschmidt <goldsimon>
Group administrator
Fri 14 Sep 2007 10:09:12 AM UTC, comment #1: 

mem_realloc is only used by pbuf_realloc, in this last one doc (previous comment), we can read "@note Despite its name, pbuf_realloc cannot grow the size of a pbuf (chain).". There is also in the pbuf_realloc code this check:

  /* desired length larger than current length? */
  if (new_len >= p->tot_len) {
    /* enlarging not yet supported */
    return;
  }

So, I think the simplest thing to do is to replace in mem.h, line 68:

#define mem_realloc(x, size) realloc(x,size)

by

#define mem_realloc(mem, size) (mem)

Frédéric Bernon <fbernon>
Group Member
Fri 14 Sep 2007 08:37:02 AM UTC, original submission:  

The pbuf_realloc() function when used with a PBUF_RAM type buffer and the MEM_LIBC_MALLOC set to 1 can fail.  The function calls mem_realloc() which is defined as realloc(). When calling realloc() there is no certainty that the pointer passed will be the same one returned. In fact, the return values is being ignored and could be null (unlikely on a shrink).

To fix the problem, the pbuf_realloc() needs to return the pointer from mem_realloc call back the calling program.

I can provide a patch for pbuf.c and pbuf.h but I suppose someone needs to evaluate where pbuf_realloc is used to see if it would be a problem and put them all in one patch.



Bill Florac <bflorac>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by fbernon (Posted a comment)
  • -email is unavailable- added by bflorac (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-09-15 fbernon StatusWorks For Me Fixed
        Open/ClosedOpen Closed
    2007-09-15 fbernon StatusNone Works For Me
        Assigned toNone fbernon
        Planned Release 1.3.0

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code