buglwIP - A Lightweight TCP/IP stack - Bugs: bug #23847, do_close_internal references freed...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #23847: do_close_internal references freed memory

Submitted by:  Simon Goldschmidt <goldsimon>
Submitted on:  Mon 14 Jul 2008 07:56:22 PM UTC  
 
Category: TCPSeverity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: CVS Head

Fri 10 Oct 2008 02:22:38 PM UTC, comment #4:

Closing since no error reports came after fixing.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 15 Jul 2008 11:19:45 AM UTC, comment #3:

Yes, very strange! I've removed it. :-)

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 15 Jul 2008 11:03:39 AM UTC, comment #2:

It doesn't build: there is a strange call to:

"tcp_connect(conn->pcb.tcp, NULL);" (line 606, api_msg.c)

:(

Frédéric Bernon <fbernon>
Project Member
Mon 14 Jul 2008 08:12:44 PM UTC, comment #1:

This was introduced last august when fixing bug #20903 (TCP callbacks called with invalid conn after close).

Since I can easily image that bug (20903) to happen, I'll change it to setting the callbacks to NULL before calling tcp_close and re-setting them to the correct value only if tcp_close fails.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Mon 14 Jul 2008 07:56:22 PM UTC, original submission:

As found by marc walrave on lwip-users:
"I have some problems closing a listening tcp socket in some test code
(using lwip 1.3.0)
I traced the problem to the do_close_internal function (from api_msg.c)

do_close_internal internally :-) calls tcp_close
Depending on the pcb state tcp_close potentially frees the pcb of the
netconn struct (via memp_free) for which do_close_internal was called
(tcp_close then returns ERR_OK).
Now after the tcp_close function returns dl_close_internal still
references the pcb pointer as if it was NOT freed?

The problem triggered memory corruption on my target beacuse the
listening socket is equipped with a smaller pcb (via
tcp_listen_with_backlog)
And the do_close_internal function incorrectly calls the tcp_poll
function on this tiny pcb leading to problems which are fortunately
detected by the MEMP_OVERFLOW_CHECK code."

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by fbernon (Posted a comment)
  • -unavailable- added by goldsimon (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 10 Oct 2008 02:22:38 PM UTCgoldsimonStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Mon 14 Jul 2008 08:12:44 PM UTCgoldsimonStatusIn Progress=>Ready For Test

    Back to the top


    Powered by Savane 3.1-cleanup1