Mon 11 Aug 2008 07:57:43 AM UTC, original submission:
I'm reporting this bug behalf of colleague:
"The error was that it was trying to pbuf_free an invalid piece of memory , because q was null, therefore q->next would be pointing at invalid memory.
I tracked the bug down to being a function in the LWIP stack , that wandered over the end of a linked list, when doing a pbuf realloc.
I fixed this by checking the list walk, and terminating the realloc if it wandered off the end of the list.
network traffic was at about 7Mbits per second."
Here is diff (WinCvs), not quit sure what was the original source version. Relevant changes q != NULL in while and new if statements.
diff -u -w -b -r1.128 pbuf.c
--- pbuf.c 1 Apr 2008 19:05:40 -0000 1.128
+++ pbuf.c 28 Jul 2008 16:36:11 -0000
@@ -291,7 +291,7 @@
rem_len = new_len;
q = p;
/* should this pbuf be kept? */
- while (rem_len > q->len) {
+ while ((rem_len > q->len) && (q != NULL)) {
/* decrease remaining length by pbuf length */
rem_len -= q->len;
/* decrease total length indicator */
@@ -302,7 +302,8 @@
}
/* we have now reached the new last pbuf (in q) */
/* rem_len == desired length for pbuf q */
-
+ if (q!=NULL)
+ {
/* shrink allocated memory for PBUF_RAM */
/* (other types merely adjust their length fields */
if ((q->type == PBUF_RAM) && (rem_len != q->len)) {
@@ -321,6 +322,7 @@
}
/* q is last packet in chain */
q->next = NULL;
+ }
}
@@ -357,8 +359,14 @@
if (header_size_increment < 0){
increment_magnitude = -header_size_increment;
+
+ if( increment_magnitude > p->len)
+ {
+ return 0;
+ }
+
/* Check that we aren't going to move off the end of the pbuf */
- LWIP_ERROR("increment_magnitude <= p->len", (increment_magnitude <= p->len), return 1;);
+ //LWIP_ERROR("increment_magnitude <= p->len", (increment_magnitude <= p->len), return 1;);
} else {
increment_magnitude = header_size_increment;
#if 0
|