buglwIP - A Lightweight TCP/IP stack - Bugs: bug #57377, Assertion "pbuf_free:...


You are not allowed to post comments on this tracker with your current authentication level.

bug #57377: Assertion "pbuf_free: p->ref > 0" failed

Submitted by:  Hiromasa Ito <vhertz>
Submitted on:  Sat 07 Dec 2019 01:17:27 PM UTC  
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  Other

Sat 07 Dec 2019 01:17:27 PM UTC, original submission:  

Hi, all.

This is one of the assertion failures I found by fuzzing (to lwIP ver2.1.0.RC1).
The following LWIP_ASSERT() at lwip/src/core/pbuf.c:753 fails.

LWIP_ASSERT("pbuf_free: p->ref > 0", p->ref > 0);

From my point of view, double-free of `p` causes this failure.
The following code is in tcp_split_unsent_seg().

seg = tcp_create_segment(pcb, p, remainder_flags, lwip_ntohl(useg->tcphdr->seqno) + split, optflags);
  if (seg == NULL) {
                ("tcp_split_unsent_seg: could not create new TCP segment\n"));
    goto memerr;

tcp_create_segment() calls pbuf_free() if no memory to allocate, and it returns NULL.


  LWIP_ASSERT("seg == NULL", seg == NULL);
  if (p != NULL) {

If tcp_create_segment() has called pbuf_free(), this is 2nd pbuf_free() call.
As a result, the assertion fails.

You can reproduce this failure with 'crashed_inputs/006' attached to the following message of lwip-devel:

Hiromasa Ito <vhertz>


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by vhertz (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    No changes have been made to this item

    Back to the top

    Powered by Savane 3.5