lwIP - A Lightweight TCP/IP stack - Bugs: bug #49218, pbuf_clen() overflow as a result...
You are not allowed to post comments on this tracker with your current authentication level.
bug #49218: pbuf_clen() overflow as a result of tcp_write concatenation
Submitter: | David van Moolenbroek <dcvmoole> | ||
Submitted: | Wed 28 Sep 2016 08:21:01 PM UTC | ||
Category: | TCP | Severity: | 3 - Normal |
Item Group: | Faulty Behaviour | Status: | Fixed |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | git head |
Jump to the original submission
Fri 30 Sep 2016 10:45:43 AM UTC, comment #6: |
David van Moolenbroek <dcvmoole> |
Fri 30 Sep 2016 10:22:14 AM UTC, comment #5:
|
Simon Goldschmidt <goldsimon> |
Fri 30 Sep 2016 10:06:01 AM UTC, comment #4:
|
David van Moolenbroek <dcvmoole> |
Fri 30 Sep 2016 09:56:41 AM UTC, comment #3:
|
David van Moolenbroek <dcvmoole> |
Fri 30 Sep 2016 07:07:02 AM UTC, comment #2: changed pbuf_clen() signature |
Dirk Ziegelmeier <dziegel> |
Fri 30 Sep 2016 06:57:38 AM UTC, comment #1: Why on earth would you chain more than 255 pbufs into one segment (which can hold 1460 bytes max.)? That would be < 6 bytes per pbuf!?!
|
Simon Goldschmidt <goldsimon> |
Wed 28 Sep 2016 08:21:01 PM UTC, original submission:
When using tcp_write() without TCP_WRITE_FLAG_COPY, a newly created pbuf may be concatenated to the pbuf chain of the last unsent segment when possible. pcb->snd_queuelen will be increased to match the total number of pbufs on the queue.
|
David van Moolenbroek <dcvmoole> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 3 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2016-09-30 | dziegel | Status | None | Fixed | |
Open/Closed | Open | Closed | |||
2016-09-28 | dcvmoole | Attached File | - | Added 0001-tcp-add-asserts-testing-pbuf-overflow.patch, #38620 |
Powered by Savane 3.13-d3ae.
Corresponding source code
That is correct, and that is the other side of why I think the ideal solution is to merge multiple consecutive buffer-local references. In that case we do eliminate an extra memory copy for all data in such circumstances, while keeping the number of chunks very low. As such I'll most probably be adding support for that locally in any case. If you think that is (in principle) something that is worthwhile might also be merged into lwIP itself, I'd be happy to make a proper patch out of it and submit it..