[lwip-devel] [bug #51937] Leaking tcp_pcbs on passive close with unacked data

[Simon Goldschmidt]

URL:
  <http://savannah.nongnu.org/bugs/?51937>

                 Summary: Leaking tcp_pcbs on passive close with unacked data
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: goldsimon
            Submitted on: Mon 04 Sep 2017 06:40:03 PM UTC
                Category: TCP
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: goldsimon
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: 2.0.2

    _______________________________________________________

Details:

When an application gets a FIN indication (recv callback with NULL pbuf) and
calls 'tcp_close()' from this callback when not having all received data ACKed
so far, the pcb can be leaked because it is removed from all pcb lists but the
check for freeing it delayed is not executed any more when unwinding the call
stack.

This is in since 2.0.0.

Suggested fix: move the "if (recv_flags & TF_CLOSED)" check in tcp_input()
further down.




    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?51937>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/