[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[lwip-devel] [bug #57790] Fragmented UDP packets leads to crash on reass
From: |
Benjamin K |
Subject: |
[lwip-devel] [bug #57790] Fragmented UDP packets leads to crash on reassembly |
Date: |
Thu, 24 Sep 2020 05:50:18 -0400 (EDT) |
User-agent: |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 |
Follow-up Comment #13, bug #57790 (project lwip):
Mentioning threading requirement is a good point, I will check that in detail.
But I think I found at least one issue in my source:
In my interface low level input method:
struct pbuf* p = pbuf_alloc(PBUF_RAW, Msg->Size, PBUF_REF);
if (p != NULL) {
p->payload = GetPayloadBuffer(Msg);
p->len = Msg->Size;
if (Interface->input(p, Interface) != ERR_OK ) {
pbuf_free(p); // On fail, we have to free the buffer
} else {
CallbackResult = 1;
// buffer is already freed internally
}
}
My Msg was actually a stack variable, I was assuming that Interface->input()
was blocking and that after that call the content of that stack variable gets
cloned. However this isn't the case especially with PBUF_REF set.
_______________________________________________________
Reply to this item at:
<https://savannah.nongnu.org/bugs/?57790>
_______________________________________________
Message sent via Savannah
https://savannah.nongnu.org/