[lwip-devel] [bug #21699] segment leak in ooseq processing when last data packet was lost

[Simon Goldschmidt]

Follow-up Comment #2, bug #21699 (project lwip):

The 'proper' way to fix it (maybe a little bit too specialized for the
scenario below) would be to change the code

inseg.len = (u16_t)(pcb->ooseq->tcphdr->seqno - seqno);
pbuf_realloc(inseg.p, inseg.len);

in tcp_receive into
if (pcb->ooseq->len > 0) {
  /* We have to trim the second edge of the incoming
     segment. */
  inseg.len = (u16_t)(pcb->ooseq->tcphdr->seqno - seqno);
  pbuf_realloc(inseg.p, inseg.len);
} else {
  /* does the ooseq segment contain only flags that are in inseg also? */
  if ((TCPH_FLAGS(inseg.tcphdr) & (TCP_FIN|TCP_SYN)) ==
      (TCPH_FLAGS(pcb->ooseq->tcphdr) & (TCP_FIN|TCP_SYN))) {
    struct tcp_seg *old_ooseq = pcb->ooseq;
    pcb->ooseq = pcb->ooseq->next;
    memp_free(MEMP_TCP_SEG, old_ooseq);
  }
}

which removes the last segment from ooseq if it contains no data and the
flags that count as segno (SYN & FIN) are the same for both segments.

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?21699>

_______________________________________________
  Nachricht geschickt von/durch Savannah
  http://savannah.nongnu.org/