lwip-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[lwip-devel] [bug #28049] Keep Alive timeout frees pcb then uses it, so


From: Mike
Subject: [lwip-devel] [bug #28049] Keep Alive timeout frees pcb then uses it, sometimes causing crash error.
Date: Wed, 18 Nov 2009 22:24:47 +0000
User-agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

URL:
  <http://savannah.nongnu.org/bugs/?28049>

                 Summary: Keep Alive timeout frees pcb then uses it,
sometimes causing crash error.
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: mikeredd
            Submitted on: Wed 18 Nov 2009 10:24:46 PM GMT
                Category: TCP
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 
            lwIP version: 1.3.1

    _______________________________________________________

Details:

Inside of tcp_slowtmr(), when a keepalive timeout occurs, tcp_abort() is
called for the pcb.  This frees the pcb.

The pcb pointer remains, however, and "pcb = pcb->next" is called at the end
of the loop.  This causes crash sometimes (because memory can be reallocated
during the sending of the RST)and is very tifficult to trace.

Here is a fix (it is also attached):


----- tcp.c (old), line 669 -----

        tcp_abort(pcb);

----- tcp.c (new), line 669-672 -----

        pcb2 = pcb->next;
        tcp_abort(pcb);
        pcb = pcb2;
        continue;

-----
 



    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Wed 18 Nov 2009 10:24:46 PM GMT  Name: tcp.c  Size: 42kB   By: mikeredd

<http://savannah.nongnu.org/bugs/download.php?file_id=19079>

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?28049>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/





reply via email to

[Prev in Thread] Current Thread [Next in Thread]