buglwIP - A Lightweight TCP/IP stack - Bugs: bug #50090, last_unsent->oversize_left can...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #50090: last_unsent->oversize_left can become wrong value in tcp_write error path

Submitter:  Axel Lin <axellin>
Submitted:  Thu 19 Jan 2017 10:27:37 AM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  2.0.0

Wed 08 Feb 2017 08:54:41 PM UTC, comment #1: 

Should be fixed (21737f57e53c9207f4f31da768aebdd160f6cdad) thanks for reporting.

Simon Goldschmidt <goldsimon>
Group administrator
Thu 19 Jan 2017 10:27:37 AM UTC, original submission:  

In Phase2: Chain a new pbuf to the end of pcb->unsent.
 492     if ((pos < len) && (space > 0) && (last_unsent->len > 0)) {
 493       u16_t seglen = LWIP_MIN(space, len - pos);
 494       seg = last_unsent;
 495
 496       /* Create a pbuf with a copy or reference to seglen bytes. We
 497        * can use PBUF_RAW here since the data appears in the middle of
 498        a segment. A header will never be prepended. /
 499       if (apiflags & TCP_WRITE_FLAG_COPY) {
 500         /* Data is copied */
 501         if ((concat_p = tcp_pbuf_prealloc(PBUF_RAW, seglen, space, &oversize, pcb, apiflags, 1)) == NULL) {
 502           LWIP_DEBUGF(TCP_OUTPUT_DEBUG | LWIP_DBG_LEVEL_SERIOUS,
 503                       ("tcp_write : could not allocate memory for pbuf copy size %"U16_F"\n",
 504                        seglen));
 505           goto memerr;
 506         }
 507 #if TCP_OVERSIZE_DBGCHECK
 508         last_unsent->oversize_left += oversize;
 509 #endif /* TCP_OVERSIZE_DBGCHECK */

last_unsent->oversize_left is already updated in line 508.

If Phase 3: Create new segments fails in any goto memerr path, last_unsent->oversize_left becomes wrong.

Axel Lin <axellin>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by axellin (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-02-08 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code