lwIP - A Lightweight TCP/IP stack - Patches: patch #7088, Support for mem_realloc moving...
You are not allowed to post comments on this tracker with your current authentication level.
patch #7088: Support for mem_realloc moving memory
Submitter: | Ken Smith <kensmith> | ||
Submitted: | Tue 09 Feb 2010 09:55:09 PM UTC | ||
Category: | None | Priority: | 5 - Normal |
Status: | Wont Do | Privacy: | Public |
Assigned to: | None | Open/Closed: | Closed |
Planned Release: | 1.4.0 |
Jump to the original submission
Fri 19 Feb 2010 04:27:48 PM UTC, comment #13: |
Simon Goldschmidt <goldsimon> |
Thu 18 Feb 2010 09:27:37 PM UTC, comment #12: When an lwIP user defines MEM_LIBC_MALLOC, mem_malloc, mem_free, and mem_calloc get mapped to potentially standards conformant implementations but mem_realloc gets neutralized so clearly, I am operating outside the design space. If there is a danger that mem_realloc assumes the pointer won't move for RAM pbufs somewhere else other than the DNS module, then I should revert my mem_realloc to the neutralized function.
|
Ken Smith <kensmith> |
Thu 18 Feb 2010 08:30:15 PM UTC, comment #11: It seems like a big part of this bug is the expectation that the lwIP mem_realloc function is like the normal realloc function, when in fact it is much more limited, and at least some of this limitation is by design. Had it been called something else, like mem_trim() this confusion would likely not have arisen.
|
Kieran Mansley <kieranm> |
Thu 18 Feb 2010 08:16:03 PM UTC, comment #10: I consider it a mistake to rely in realloc not moving memory since realloc has been allowed to move the pointer since C89 and probably before.
|
Ken Smith <kensmith> |
Thu 18 Feb 2010 07:44:47 PM UTC, comment #9: The potential problem is that there may be other pointers into the region of memory that is moved. These pointers would also need to be updated. |
Kieran Mansley <kieranm> |
Thu 18 Feb 2010 06:23:49 PM UTC, comment #8: Simon,
|
Ken Smith <kensmith> |
Thu 18 Feb 2010 11:00:06 AM UTC, comment #7: I'm happy with the current behaviour, but we should add some comments to the source and/or porting docs to explain that mem_realloc() can't move the memory. |
Kieran Mansley <kieranm> |
Thu 18 Feb 2010 06:34:23 AM UTC, comment #6: Sorry for not being too clear. Let me first how I see this:
|
Simon Goldschmidt <goldsimon> |
Wed 17 Feb 2010 09:37:02 PM UTC, comment #5: I don't see how it trades saving memory for memcpy where we could prevent it. It simply allows for the possibility that realloc will return a new location for the allocation in the case of RAM pbufs. Please elaborate on what you mean. |
Ken Smith <kensmith> |
Wed 17 Feb 2010 09:25:11 PM UTC, comment #4: The discussion about this went on a bit on lwip-devel but didn't really come to an end. Does anyone have a strong need for this to get in given the fact that this trades saving some memory for memcpy where we could prevent it? |
Simon Goldschmidt <goldsimon> |
Fri 12 Feb 2010 02:54:34 PM UTC, comment #3: Updated the summary to better reflect this entry's contents. |
Simon Goldschmidt <goldsimon> |
Thu 11 Feb 2010 03:09:38 PM UTC, comment #2: I do see problems here, for example in ip_input: at the start of the function, iphdr is set to p->payload. That patch attached here reallocs the pbuf but does not change all pointers that already point into p->payload!
|
Simon Goldschmidt <goldsimon> |
Thu 11 Feb 2010 12:35:22 PM UTC, comment #1: Note that this isn't really a bug in lwIP. The standard definition of pbuf_realloc() and mem_realloc() guarantee not to change the memory pointed to by the pbuf, just reduce the length of the pbuf.
|
Kieran Mansley <kieranm> |
Tue 09 Feb 2010 09:55:09 PM UTC, original submission:
I am using the raw DNS API and have #define'ed MEM_LIBC_MALLOC. I have custom implementations of malloc and realloc. My realloc implementation, like the standard C implementation, may change the address of the allocation. Here is the call stack that gets into a double free situation.
|
Ken Smith <kensmith> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2010-02-19 | goldsimon | Status | None | Wont Do | |
Open/Closed | Open | Closed | |||
2010-02-12 | goldsimon | Summary | DNS with custom malloc/realloc contains a double free in RAM pbuf realloc | Support for mem_realloc moving memory | |
2010-02-11 | kieranm | Planned Release | None | 1.4.0 | |
2010-02-09 | kensmith | Attached File | - | Added pbuf-realloc.patch, #19666 |
Powered by Savane 3.13-02a9.
Corresponding source code
Renamed mem_realloc to mem_trim as suggested in comment #11