buglwIP - A Lightweight TCP/IP stack - Bugs: bug #36561, Some netifapi functions handle...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #36561: Some netifapi functions handle pointers to stale objects

Submitter:  Mason <mason>
Submitted:  Wed 30 May 2012 01:43:28 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Invalid
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.4.0

Wed 30 May 2012 02:16:46 PM UTC, comment #1: 

That's no bug, because:

- TCPIP_NETIFAPI() (as called by netifapi_netif_add()) waits for tcpip_callback() to return, so when netif_add() is called, the address is still valid.

- both netif_add() and netif_set_addr() copy the address into ip_addr_t members of struct netif, so the original pointers are not referenced after the function returns.

Simon Goldschmidt <goldsimon>
Group administrator
Wed 30 May 2012 01:43:28 PM UTC, original submission:  

I think there's a bug in
netifapi_netif_add
netifapi_netif_set_addr

These functions receive pointers to ip_addr_t objects
(ipaddr, netmask, gw) which likely "live" on the stack.
The pointers are copied to a message, which is posted
to the tcpip_thread.

When the tcpip_thread receives the message, the thread
that requested the operation has likely moved on, and
the ip_addr_t objects no longer exist. The pointers to
these objects are thus invalid.

Proposed solution (untested): in struct netifapi_msg_msg,
we could store the actual ip_addr_t objects, instead of
pointers to these objects.

Mason <mason>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by mason (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-05-30 goldsimon StatusNone Invalid
        Assigned toNone goldsimon
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code