buglwIP - A Lightweight TCP/IP stack - Bugs: bug #34526, nd6_queue_packet() frees too much...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #34526: nd6_queue_packet() frees too much if out-of-memory

Submitted by:  Simon Goldschmidt <goldsimon>
Submitted on:  Tue 11 Oct 2011 10:55:32 AM UTC  
 
Category: IPv6Severity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Ivan Delamer <idelamer>
Open/Closed: ClosedPlanned Release: None
lwIP version: CVS Head

Wed 26 Oct 2011 08:42:48 PM UTC, comment #1:

Good catch, Simon. Fixed by setting r->next = NULL before calling nd6_free_q.

Also, in the first call, we were perhaps not freeing enough. Changed the if() to a while() so that it frees until we can allocate the pbuf or definitely fail.

Ivan Delamer <idelamer>
Project MemberIn charge of this item.
Tue 11 Oct 2011 10:55:32 AM UTC, original submission:

This is from reading the code only, I don't have the time to check it right now but don't want to forget it:

In nd6_queue_packet() lines 1550 and 1573, nd6_free_q() is called (which frees all queues until ->next is NULL) without setting q->next to NULL. Although, q->next is rememberd.

I think this is wrong as I think the code wants to free one queue entry only, although it would free all queue entries (for that neighbor_index) as it is now.

Simon Goldschmidt <goldsimon>
Project Administrator

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by idelamer (Posted a comment)
  • -unavailable- added by goldsimon (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 26 Oct 2011 08:43:33 PM UTCidelamerItem GroupNone=>Faulty Behaviour
      StatusNone=>Fixed
      Assigned toNone=>idelamer
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1