[lwip-devel] [patch #7088] DNS with custom malloc/realloc contains a double free in RAM pbuf realloc

[Ken Smith]

URL:
  <http://savannah.nongnu.org/patch/?7088>

                 Summary: DNS with custom malloc/realloc contains a double
free in RAM pbuf realloc
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: kensmith
            Submitted on: Tue 09 Feb 2010 09:55:09 PM GMT
                Category: None
                Priority: 5 - Normal
                  Status: None
                 Privacy: Public
             Assigned to: None
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None

    _______________________________________________________

Details:

I am using the raw DNS API and have #define'ed MEM_LIBC_MALLOC.  I have
custom implementations of malloc and realloc.  My realloc implementation, like
the standard C implementation, may change the address of the allocation.  Here
is the call stack that gets into a double free situation.

dns_gethosbyname
dns_enqueue
dns_check_entry
dns_send
   p is a RAM pbuf
   p is pbuf_realloced
   for RAM pbufs, pbuf_realloc calls mem_realloc
     which my implementation replaces with a
     custom realloc
   p is freed (this is the second free since
     realloc performed a free)

The newly allocated memory has a different address but that address is not
given to the caller.  The original p is freed so the caller is holding invalid
memory and dns_send calls free on an already freed buffer.

Please find attached a patch which resolves this issue by changing the
interface to pbuf_realloc.



    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Tue 09 Feb 2010 09:55:09 PM GMT  Name: pbuf-realloc.patch  Size: 12kB  
By: kensmith

<http://savannah.nongnu.org/patch/download.php?file_id=19666>

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/patch/?7088>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/