lwIP - A Lightweight TCP/IP stack - Bugs: bug #50424, Double free of http_state when...
You are not allowed to post comments on this tracker with your current authentication level.
bug #50424: Double free of http_state when post data enabled
Submitter: | Josh Green <jgreen> | ||
Submitted: | Wed 01 Mar 2017 12:30:38 AM UTC | ||
Category: | None | Severity: | 3 - Normal |
Item Group: | Crash Error | Status: | Fixed |
Privacy: | Public | Assigned to: | goldsimon |
Open/Closed: | Closed | Planned Release: | 2.0.2 |
lwIP version: | 2.0.0 |
Jump to the original submission
Wed 01 Mar 2017 09:11:37 PM UTC, comment #7: |
Simon Goldschmidt <goldsimon> |
Wed 01 Mar 2017 08:18:05 PM UTC, comment #6: Yes, that appears to fix the issue. Thank you kindly. |
Josh Green <jgreen> |
Wed 01 Mar 2017 07:35:20 PM UTC, comment #5: Could you try the attached patch? I couldn't test it here, but this probably fixes it. The code seems to fail to handle nested 'recved' call (at least I always have called it deferred, when the flash operation has finished). |
Simon Goldschmidt <goldsimon> |
Wed 01 Mar 2017 07:15:35 PM UTC, comment #4: Alright, I'll check this again. |
Simon Goldschmidt <goldsimon> |
Wed 01 Mar 2017 05:49:09 PM UTC, comment #3: I enabled auto window behavior and this problem went away. I do need manual window behavior however for software updates which need to throttle data to FLASH. I'm still fairly certain this is an issue with lwIP. Here is some pseudo logic of how this happens when manual window updates are enabled:
|
Josh Green <jgreen> |
Wed 01 Mar 2017 04:09:18 PM UTC, comment #2: In answer to your question about the first stack trace. gcc size optimization -Os is causing some function calls to not be shown. My httpd_post_receive_data() is using manual window updates (should have mentioned that in the bug). The call to http_send() occurs when my httpd_post_receive_data() calls httpd_post_data_recved().
|
Josh Green <jgreen> |
Wed 01 Mar 2017 07:43:19 AM UTC, comment #1: I don't understand your first callstack. How can your application callback 'httpd_post_receive_data()' possibly call into 'http_send()', which is static in httpd.c since it is an internal function?
|
Simon Goldschmidt <goldsimon> |
Wed 01 Mar 2017 12:30:38 AM UTC, original submission:
I'm getting double frees in the 2.0.1 httpd app. I've customized the code somewhat to handle unknown custom file lengths (for dynamic POST data responses), but I don't think this issue is related to those changes. This worked fine with the HTTP server in lwIP 1.0.4.
|
Josh Green <jgreen> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 12 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2017-03-01 | goldsimon | Status | In Progress | Fixed | |
Open/Closed | Open | Closed | |||
2017-03-01 | goldsimon | Attached File | - | Added bug50424_1.patch, #39871 | |
Status | None | In Progress | |||
Assigned to | None | goldsimon | |||
Planned Release | None | 2.0.2 | |||
2017-03-01 | goldsimon | Status | Invalid | None | |
Open/Closed | Closed | Open | |||
2017-03-01 | goldsimon | Status | None | Invalid | |
Open/Closed | Open | Closed | |||
2017-03-01 | jgreen | Attached File | - | Added lwIP-httpd-double-free.txt, #39857 | |
Attached File | - | Added lwipopts.h, #39858 |
Powered by Savane 3.13-3230.
Corresponding source code
Well, thanks for insisting on this even after being rejected :-)
Pushed in http://git.savannah.gnu.org/cgit/lwip.git/commit/?id=05a595f74559f45a1d46f7457c484012b4f83f1a