buglwIP - A Lightweight TCP/IP stack - Bugs: bug #27252, Address pointer invalid after...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #27252: Address pointer invalid after freeing pbuf in UDP receive callback

Submitter:  Ben Hastings <hastings>
Submitted:  Fri 14 Aug 2009 03:18:44 PM UTC
   
 
Category:  UDP Severity:  3 - Normal
Item Group:  Change Request Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  CVS Head

Wed 07 Oct 2009 05:51:43 PM UTC, comment #5: 

Fixed by reverting to the code before and adding a warning at the recv-callback definition in struct udp_pcb.

Simon Goldschmidt <goldsimon>
Group administrator
Sat 03 Oct 2009 06:19:28 PM UTC, comment #4: 

I'll fix this for 1.3.2.

Simon Goldschmidt <goldsimon>
Group administrator
Tue 15 Sep 2009 05:31:13 PM UTC, comment #3: 

The workaround (making a local copy of the address) isn't difficult and should only be necessary if the user code frees the incoming pbuf before sending out a response.  Would it make more sense to document the behavior than to change the code?

Ben Hastings <hastings>
Sun 30 Aug 2009 09:06:15 PM UTC, comment #2: 

Uhm, seems like I missed one thing here: netbufs don't copy the address but only the pointer to the address, which collides with this change because as it is now, the address doesn't survive the thread change from tcpip_thread to the application thread where the netbuf is used.

Personally, I'd favour changing the struct netbuf to include a struct ip_addr instead of its pointer.

Simon Goldschmidt <goldsimon>
Group administrator
Sun 23 Aug 2009 11:33:18 AM UTC, comment #1: 

Fixed by copying the address to the stack before calling the recv callback function.

Simon Goldschmidt <goldsimon>
Group administrator
Fri 14 Aug 2009 03:18:44 PM UTC, original submission:  

After the pbuf is freed in the UDP receive callback, the address pointer passed to the function may no longer be valid.

--- From lwip-users ---

Ben Hastings wrote:

> On a side note, what happens if the pbuf is freed before the end of
> the callback?  Does that also free the memory that the address pointer
> points to?
>  


That's a good point. Since p->ref is (almost always) == 1 at the point where the pbuf is passed to the receive callback, it will get freed when
pbuf_free(p) is called. I'd still vote for copying the address before calling the receive callback function. It might be a little less performant, but safer.

Simon

Ben Hastings <hastings>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by kieranm (Updated the item)
  • -email is unavailable- added by hastings (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-10-07 goldsimon StatusIn Progress Fixed
        Open/ClosedOpen Closed
    2009-10-03 goldsimon Planned Release1.4.0 1.3.2
    2009-08-30 goldsimon StatusFixed In Progress
        Open/ClosedClosed Open
    2009-08-23 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2009-08-20 kieranm Planned Release 1.4.0

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code