buglwIP - A Lightweight TCP/IP stack - Bugs: bug #21075, pbuf_realloc() use with PBUF_RAM...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #21075: pbuf_realloc() use with PBUF_RAM and MEM_LIBC_MALLOC fails

Submitted by:  Bill Florac <bflorac>
Submitted on:  Fri 14 Sep 2007 08:37:02 AM UTC  
 
Category: pbufsSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Fixed
Privacy: PublicAssigned to: Frédéric Bernon <fbernon>
Open/Closed: ClosedPlanned Release: None
lwIP version: None

Sat 15 Sep 2007 07:36:43 AM UTC, comment #4:

ok for Bill, so, I close it...

Frédéric Bernon <fbernon>
Project MemberIn charge of this item.
Sat 15 Sep 2007 06:59:08 AM UTC, comment #3:

Ok, I have chat with Bill, and it's "better than nothing!". So, I check in the patch. Bill, can I close it ?

Frédéric Bernon <fbernon>
Project MemberIn charge of this item.
Fri 14 Sep 2007 10:38:54 AM UTC, comment #2:

> So, I think the simplest thing to do is to replace in mem.h, line 68:
> #define mem_realloc(x, size) realloc(x,size)
> by
> #define mem_realloc(mem, size) (mem)


I also think that's the best idea, since I don't think it's performant to really use realloc() just to shrink a pbuf's payload size.

Also, I'm not sure this would really work, using realloc() might need some modifications on the whole core code so that a payload pointer is not being saved... And since MEM_LIBC_MALLOC was originally only a workaroung for the broken mem_malloc(), I think that defining mem_realloc to doing nothing is best.

Simon Goldschmidt <goldsimon>
Project Administrator
Fri 14 Sep 2007 10:09:12 AM UTC, comment #1:

mem_realloc is only used by pbuf_realloc, in this last one doc (previous comment), we can read "@note Despite its name, pbuf_realloc cannot grow the size of a pbuf (chain).". There is also in the pbuf_realloc code this check:

/* desired length larger than current length? */
if (new_len >= p->tot_len) {
/* enlarging not yet supported */
return;
}

So, I think the simplest thing to do is to replace in mem.h, line 68:

#define mem_realloc(x, size) realloc(x,size)

by

#define mem_realloc(mem, size) (mem)

Frédéric Bernon <fbernon>
Project MemberIn charge of this item.
Fri 14 Sep 2007 08:37:02 AM UTC, original submission:

The pbuf_realloc() function when used with a PBUF_RAM type buffer and the MEM_LIBC_MALLOC set to 1 can fail. The function calls mem_realloc() which is defined as realloc(). When calling realloc() there is no certainty that the pointer passed will be the same one returned. In fact, the return values is being ignored and could be null (unlikely on a shrink).

To fix the problem, the pbuf_realloc() needs to return the pointer from mem_realloc call back the calling program.

I can provide a patch for pbuf.c and pbuf.h but I suppose someone needs to evaluate where pbuf_realloc is used to see if it would be a problem and put them all in one patch.

Bill Florac <bflorac>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by fbernon (Posted a comment)
  • -unavailable- added by bflorac (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 15 Sep 2007 07:36:43 AM UTCfbernonStatusWorks For Me=>Fixed
      Open/ClosedOpen=>Closed
    Sat 15 Sep 2007 06:59:08 AM UTCfbernonStatusNone=>Works For Me
      Assigned toNone=>fbernon
      Planned Release=>1.3.0

    Back to the top


    Powered by Savane 3.1-cleanup1