buglwIP - A Lightweight TCP/IP stack - Bugs: bug #50424, Double free of http_state when...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #50424: Double free of http_state when post data enabled

Submitted by:  Josh Green <jgreen>
Submitted on:  Wed 01 Mar 2017 12:30:38 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: 2.0.2
lwIP version: 2.0.0

(Jump to the original submission Jump to the original submission)

Wed 01 Mar 2017 09:11:37 PM UTC, comment #7:

Well, thanks for insisting on this even after being rejected :-)

Pushed in http://git.savannah.gnu.org/cgit/lwip.git/commit/?id=05a595f74559f45a1d46f7457c484012b4f83f1a

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 01 Mar 2017 08:18:05 PM UTC, comment #6:

Yes, that appears to fix the issue. Thank you kindly.

Josh Green <jgreen>
Wed 01 Mar 2017 07:35:20 PM UTC, comment #5:

Could you try the attached patch? I couldn't test it here, but this probably fixes it. The code seems to fail to handle nested 'recved' call (at least I always have called it deferred, when the flash operation has finished).

(file #39871)

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 01 Mar 2017 07:15:35 PM UTC, comment #4:

Alright, I'll check this again.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 01 Mar 2017 05:49:09 PM UTC, comment #3:

I enabled auto window behavior and this problem went away. I do need manual window behavior however for software updates which need to throttle data to FLASH. I'm still fairly certain this is an issue with lwIP. Here is some pseudo logic of how this happens when manual window updates are enabled:

http_recv:
call http_post_rxpbuf()
call httpd_post_receive_data()
call httpd_post_data_recved()
if hs != NULL && hs->no_auto_wnd:
hs->unrecved_bytes = 0
if hs->post_content_len_left == 0 && hs->unrecved_bytes == 0:
call http_send()
if hs->unrecved_bytes == 0 && hs != NULL:
if hs->left == 0 && fs_bytes_left (hs->handle) == 0:
call http_eof()

if hs->post_content_len_left == 0:
call http_send()
if hs->unrecved_bytes == 0 && hs != NULL:
if hs->left == 0 && fs_bytes_left (hs->handle) == 0:
call http_eof()

Josh Green <jgreen>
Wed 01 Mar 2017 04:09:18 PM UTC, comment #2:

In answer to your question about the first stack trace. gcc size optimization -Os is causing some function calls to not be shown. My httpd_post_receive_data() is using manual window updates (should have mentioned that in the bug). The call to http_send() occurs when my httpd_post_receive_data() calls httpd_post_data_recved().

I'm certainly not apposed to the idea that I'm somehow breaking httpd, still troubleshooting. Feel free to leave closed for now, I'll reopen it if I find that it is indeed a lwIP issue.

Josh Green <jgreen>
Wed 01 Mar 2017 07:43:19 AM UTC, comment #1:

I don't understand your first callstack. How can your application callback 'httpd_post_receive_data()' possibly call into 'http_send()', which is static in httpd.c since it is an internal function?

Seems like you broke the code with your changes and think it's lwIP's fault...

--> closing this as invalid, please feel free to convince me of the opposite if I'm wrong :-)

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 01 Mar 2017 12:30:38 AM UTC, original submission:

I'm getting double frees in the 2.0.1 httpd app. I've customized the code somewhat to handle unknown custom file lengths (for dynamic POST data responses), but I don't think this issue is related to those changes. This worked fine with the HTTP server in lwIP 1.0.4.

In http_recv() http_post_rxpbuf() is called where the first call to http_eof() occurs.

After returning from http_post_rxpbuf() the http_state should no longer be used, but it is with the statement:
if (hs->post_content_len_left == 0)

http_send is then called, which calls http_eof() again, causing a double free.

Attached are backtraces for both frees. Please note that line numbers will not match stock 2.0.1 lwIP.

Also attached is my lwipopts.h header file.

Josh Green <jgreen>

 

Attached Files
file #39871:  bug50424_1.patch added by goldsimon (796B - application/octet-stream)
file #39858:  lwipopts.h added by jgreen (2KiB - text/x-chdr)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by jgreen (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 12 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 01 Mar 2017 09:11:37 PM UTCgoldsimonStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Wed 01 Mar 2017 07:35:20 PM UTCgoldsimonAttached File-=>Added bug50424_1.patch, #39871
      StatusNone=>In Progress
      Assigned toNone=>goldsimon
      Planned ReleaseNone=>2.0.2
    Wed 01 Mar 2017 07:15:35 PM UTCgoldsimonStatusInvalid=>None
      Open/ClosedClosed=>Open
    Wed 01 Mar 2017 07:43:19 AM UTCgoldsimonStatusNone=>Invalid
      Open/ClosedOpen=>Closed
    Wed 01 Mar 2017 12:30:38 AM UTCjgreenAttached File-=>Added lwIP-httpd-double-free.txt, #39857
      Attached File-=>Added lwipopts.h, #39858

    Back to the top


    Powered by Savane 3.1-cleanup1