lwIP - A Lightweight TCP/IP stack - Bugs: bug #23693, tcp_receive does not handle 'no...
You are not allowed to post comments on this tracker with your current authentication level.
bug #23693: tcp_receive does not handle 'no more segs available' from tcp_seg_copy
Submitter: | Art R. <tdir> | ||
Submitted: | Tue 24 Jun 2008 02:40:17 PM UTC | ||
Category: | TCP | Severity: | 3 - Normal |
Item Group: | Crash Error | Status: | Fixed |
Privacy: | Public | Assigned to: | jifl |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | 1.3.0 |
Wed 25 Jun 2008 01:01:47 PM UTC, comment #5: |
Jonathan Larmour <jifl> |
Wed 25 Jun 2008 12:27:20 PM UTC, comment #4: There is a change in functionality with the proposed change. If cseg is NULL, it's bypassing the
|
Bill Auerbach <billauerbach> |
Tue 24 Jun 2008 03:49:46 PM UTC, comment #3: Mid-air collision here :)
|
Jonathan Larmour <jifl> |
Tue 24 Jun 2008 03:48:32 PM UTC, comment #2: Fix as proposed by Art R.:
|
Simon Goldschmidt <goldsimon> |
Tue 24 Jun 2008 03:48:26 PM UTC, comment #1: I've looked at it carefully, and I'm happy applying a fix here (fatal last words), which I've now checked in.
|
Jonathan Larmour <jifl> |
Tue 24 Jun 2008 02:40:17 PM UTC, original submission:
The function tcp_receive() in tcp_in.c can fail by dereferencing a NULL pointer if the seg pool has no more available segs. The code calls tcp_seg_copy() to get a seg but does not properly handle the case where a NULL result is returned (indicating there are no more available segs).
|
Art R. <tdir> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2008-06-24 | jifl | Status | None | Fixed | |
Assigned to | None | jifl | |||
Open/Closed | Open | Closed | |||
2008-06-24 | goldsimon | Status | Fixed | None | |
Assigned to | jifl | None | |||
Open/Closed | Closed | Open | |||
2008-06-24 | jifl | Status | None | Fixed | |
Assigned to | None | jifl | |||
Open/Closed | Open | Closed |
Powered by Savane 3.13-02a9.
Corresponding source code
This is correct. We should be dropping the new incoming seg and leaving the pcb->ooseq list as it was. Therefore we should not be changing it by calling tcp_seg_free(next), and doing so before was erroneous if cseg is NULL. So the fix described, and the fix checked in, are (I believe :-)) still correct.