lwIP - A Lightweight TCP/IP stack - Bugs: bug #51789, TCP_EVENT_CLOSE, tcp_close() and...
You are not allowed to post comments on this tracker with your current authentication level.
bug #51789: TCP_EVENT_CLOSE, tcp_close() and possible use of pcb with tcp_output()
Submitter: | Art Heers <artheers> | ||
Submitted: | Fri 18 Aug 2017 09:28:34 PM UTC | ||
Category: | TCP | Severity: | 3 - Normal |
Item Group: | Faulty Behaviour | Status: | Invalid |
Privacy: | Public | Assigned to: | goldsimon |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | 2.0.0 |
Jump to the original submission
Mon 28 Aug 2017 05:45:20 PM UTC, comment #7: |
Simon Goldschmidt <goldsimon> |
Mon 28 Aug 2017 03:19:31 PM UTC, comment #6:
|
Art Heers <artheers> |
Mon 28 Aug 2017 06:56:17 AM UTC, comment #5: TF_GOT_FIN is set in tcp_receive(), which is not called from tcp_process() if the pcb is in SYN_SENT state.
|
Simon Goldschmidt <goldsimon> |
Fri 25 Aug 2017 09:01:51 PM UTC, comment #4: > OK, if you tell me where a pcb in SYN_SENT accepts a FIN,...
|
Art Heers <artheers> |
Tue 22 Aug 2017 07:32:44 PM UTC, comment #3: Right, I see now how tcp_close() gets called with recv==NULL.
|
Simon Goldschmidt <goldsimon> |
Tue 22 Aug 2017 06:47:51 PM UTC, comment #2: Yes, TCP_EVENT_CLOSED.
*/
|
Art Heers <artheers> |
Mon 21 Aug 2017 07:08:17 AM UTC, comment #1:
|
Simon Goldschmidt <goldsimon> |
Fri 18 Aug 2017 09:28:34 PM UTC, original submission:
I am not sure, but if the call back function pcb->recv does tcp_close(pcb) when TCP_EVENT_CLOSE is the call back, which it does if pcb->recv is NULL, it is possible the tcp_close(pcb) will deallocate pcb if the pcb is in certain states, like CLOSED. Yet subsequent to the call back the pcb is used by calling tcp_output(pcb). This obviously can cause a memory corruption.
|
Art Heers <artheers> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 4 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2017-08-21 | goldsimon | Status | None | Invalid | |
Assigned to | None | goldsimon | |||
Open/Closed | Open | Closed | |||
2017-08-18 | artheers | Carbon-Copy | - | Added -email is unavailable- |
Powered by Savane 3.13-758e.
Corresponding source code
I' not aware of this bug for 1.4.0. Please report back here if you find it in current git head (which I'm convinced doesn't have this bug).