buglwIP - A Lightweight TCP/IP stack - Bugs: bug #50424, Double free of http_state when...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #50424: Double free of http_state when post data enabled

Submitter:  Josh Green <jgreen>
Submitted:  Wed 01 Mar 2017 12:30:38 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  2.0.2
lwIP version:  2.0.0

Jump to the original submission

Wed 01 Mar 2017 09:11:37 PM UTC, comment #7: 

Well, thanks for insisting on this even after being rejected :-)

Pushed in http://git.savannah.gnu.org/cgit/lwip.git/commit/?id=05a595f74559f45a1d46f7457c484012b4f83f1a

Simon Goldschmidt <goldsimon>
Group administrator
Wed 01 Mar 2017 08:18:05 PM UTC, comment #6: 

Yes, that appears to fix the issue.  Thank you kindly.

Josh Green <jgreen>
Wed 01 Mar 2017 07:35:20 PM UTC, comment #5: 

Could you try the attached patch? I couldn't test it here, but this probably fixes it. The code seems to fail to handle nested 'recved' call (at least I always have called it deferred, when the flash operation has finished).

(file #39871)

Simon Goldschmidt <goldsimon>
Group administrator
Wed 01 Mar 2017 07:15:35 PM UTC, comment #4: 

Alright, I'll check this again.

Simon Goldschmidt <goldsimon>
Group administrator
Wed 01 Mar 2017 05:49:09 PM UTC, comment #3: 

I enabled auto window behavior and this problem went away.  I do need manual window behavior however for software updates which need to throttle data to FLASH.  I'm still fairly certain this is an issue with lwIP.  Here is some pseudo logic of how this happens when manual window updates are enabled:

http_recv:
  call http_post_rxpbuf()
    call httpd_post_receive_data()
      call httpd_post_data_recved()
        if hs != NULL && hs->no_auto_wnd:
        hs->unrecved_bytes = 0
        if hs->post_content_len_left == 0 && hs->unrecved_bytes == 0:
          call http_send()
            if hs->unrecved_bytes == 0 && hs != NULL:
            if hs->left == 0 && fs_bytes_left (hs->handle) == 0:
              call http_eof()

  if hs->post_content_len_left == 0:
    call http_send()
      if hs->unrecved_bytes == 0 && hs != NULL:
      if hs->left == 0 && fs_bytes_left (hs->handle) == 0:
        call http_eof()

Josh Green <jgreen>
Wed 01 Mar 2017 04:09:18 PM UTC, comment #2: 

In answer to your question about the first stack trace.  gcc size optimization -Os is causing some function calls to not be shown.  My httpd_post_receive_data() is using manual window updates (should have mentioned that in the bug).  The call to http_send() occurs when my httpd_post_receive_data() calls httpd_post_data_recved(). 

I'm certainly not apposed to the idea that I'm somehow breaking httpd, still troubleshooting.  Feel free to leave closed for now, I'll reopen it if I find that it is indeed a lwIP issue.

Josh Green <jgreen>
Wed 01 Mar 2017 07:43:19 AM UTC, comment #1: 

I don't understand your first callstack. How can your application callback 'httpd_post_receive_data()' possibly call into 'http_send()', which is static in httpd.c since it is an internal function?

Seems like you broke the code with your changes and think it's lwIP's fault...

--> closing this as invalid, please feel free to convince me of the opposite if I'm wrong :-)

Simon Goldschmidt <goldsimon>
Group administrator
Wed 01 Mar 2017 12:30:38 AM UTC, original submission:  

I'm getting double frees in the 2.0.1 httpd app.  I've customized the code somewhat to handle unknown custom file lengths (for dynamic POST data responses), but I don't think this issue is related to those changes.  This worked fine with the HTTP server in lwIP 1.0.4.

In http_recv() http_post_rxpbuf() is called where the first call to http_eof() occurs.

After returning from http_post_rxpbuf() the http_state should no longer be used, but it is with the statement:
if (hs->post_content_len_left == 0)

http_send is then called, which calls http_eof() again, causing a double free.


Attached are backtraces for both frees.  Please note that line numbers will not match stock 2.0.1 lwIP.

Also attached is my lwipopts.h header file.

Josh Green <jgreen>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #39871:  bug50424_1.patch added by goldsimon (796B - application/octet-stream)
file #39858:  lwipopts.h added by jgreen (2KiB - text/x-chdr)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by jgreen (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 12 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-03-01 goldsimon StatusIn Progress Fixed
        Open/ClosedOpen Closed
    2017-03-01 goldsimon Attached File- Added bug50424_1.patch, #39871
        StatusNone In Progress
        Assigned toNone goldsimon
        Planned ReleaseNone 2.0.2
    2017-03-01 goldsimon StatusInvalid None
        Open/ClosedClosed Open
    2017-03-01 goldsimon StatusNone Invalid
        Open/ClosedOpen Closed
    2017-03-01 jgreen Attached File- Added lwIP-httpd-double-free.txt, #39857
        Attached File- Added lwipopts.h, #39858

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code