buglwIP - A Lightweight TCP/IP stack - Bugs: bug #34526, nd6_queue_packet() frees too much...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #34526: nd6_queue_packet() frees too much if out-of-memory

Submitter:  Simon Goldschmidt <goldsimon>
Submitted:  Tue 11 Oct 2011 10:55:32 AM UTC
   
 
Category:  IPv6 Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  idelamer
Open/Closed:  Closed Planned Release:  None
lwIP version:  CVS Head

Wed 26 Oct 2011 08:42:48 PM UTC, comment #1: 

Good catch, Simon. Fixed by setting r->next = NULL before calling nd6_free_q.

Also, in the first call, we were perhaps not freeing enough. Changed the if() to a while() so that it frees until we can allocate the pbuf or definitely fail.

Ivan Delamer <idelamer>
Group Member
Tue 11 Oct 2011 10:55:32 AM UTC, original submission:  

This is from reading the code only, I don't have the time to check it right now but don't want to forget it:

In nd6_queue_packet() lines 1550 and 1573, nd6_free_q() is called (which frees all queues until ->next is NULL) without setting q->next to NULL. Although, q->next is rememberd.

I think this is wrong as I think the code wants to free one queue entry only, although it would free all queue entries (for that neighbor_index) as it is now.

Simon Goldschmidt <goldsimon>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by idelamer (Posted a comment)
  • -email is unavailable- added by goldsimon (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-10-26 idelamer Item GroupNone Faulty Behaviour
        StatusNone Fixed
        Assigned toNone idelamer
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code