buglwIP - A Lightweight TCP/IP stack - Bugs: bug #12591, tcp_enqueue: *queue is not set but...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #12591: tcp_enqueue: *queue is not set but tcp_segs_free'd later, if the limit TCP_SND_QUEUELEN is reached

Submitted by:  None
Submitted on:  Thu 07 Apr 2005 11:33:58 AM UTC  
 
Category: TCPSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: ClosedPlanned Release: None
lwIP version: None

Fri 17 Nov 2006 11:45:12 AM UTC, comment #2:

*queue in tcp_enqueue() is initialized in tcp_out.c HEAD, assuming it was fixed, but not closed in this tracker.

Christiaan Simons <christiaans>
Project Member
Wed 25 May 2005 05:15:07 AM UTC, comment #1:

I found this same bug. Here is a more detailed explanation.

In tcp_out.c in version 1.1.0, the system can crash when the queue is full in tcp_enqueue(). The variable "queue" is not initialized to NULL when declared, and not all systems automatically initialize local variable memory space to 0. On systems where uninitialized variables are not zeroed, and a branch to "memerr" occurs before it is set (as when TCP_SND_QUEUELEN is reached as original author pointed out) will cause this memerr code to crash:

if (queue != NULL) {
tcp_segs_free(queue);
}

because queue will be some random uninitialized garbage.

To fix the problem, initialize the queue variable to NULL.

Greg Sadosuk
-unavailable-

Anonymous
Thu 07 Apr 2005 11:33:58 AM UTC, original submission:
Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 2 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Fri 17 Nov 2006 11:45:12 AM UTCchristiaansStatusNone=>Fixed
  Open/ClosedOpen=>Closed

Back to the top


Powered by Savane 3.1-cleanup1