[lwip-devel] [bug #27252] Address pointer invalid after freeing pbuf in UDP receive callback

[Ben Hastings]

URL:
  <http://savannah.nongnu.org/bugs/?27252>

                 Summary: Address pointer invalid after freeing pbuf in UDP
receive callback
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: hastings
            Submitted on: Fri 14 Aug 2009 11:18:44 AM EDT
                Category: UDP
                Severity: 3 - Normal
              Item Group: Change Request
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 
            lwIP version: CVS Head

    _______________________________________________________

Details:

After the pbuf is freed in the UDP receive callback, the address pointer
passed to the function may no longer be valid.

--- From lwip-users ---

Ben Hastings wrote:
> On a side note, what happens if the pbuf is freed before the end of 
> the callback?  Does that also free the memory that the address pointer 
> points to?
>   

That's a good point. Since p->ref is (almost always) == 1 at the point where
the pbuf is passed to the receive callback, it will get freed when
pbuf_free(p) is called. I'd still vote for copying the address before calling
the receive callback function. It might be a *little* less performant, but
safer.

Simon





    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?27252>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/