[lwip-users] Re: [lwip] uses struct member after free - bug

[Xavier Hanin]

Thanks Paul for having spotted this one as well!

As a conclusion for the last 2 bugs in tcp_listen (src/core/tcp.c) , here's the 
fix.

Xavier.


struct tcp_pcb *
tcp_listen(struct tcp_pcb *pcb)
{
  struct tcp_pcb_listen *lpcb;

  lpcb = memp_malloc(MEMP_TCP_PCB_LISTEN);
  if(lpcb == NULL) {
    return NULL;
  }

  lpcb->callback_arg = pcb->callback_arg;
  lpcb->local_port = pcb->local_port;
  ip_addr_set(&lpcb->local_ip, &pcb->local_ip);

  memp_free(MEMP_TCP_PCB, pcb); 

#if LWIP_CALLBACK_API
  lpcb->accept = tcp_accept_null;
#endif /* LWIP_CALLBACK_API */
  TCP_REG( ((struct tcp_pcb **)&tcp_listen_pcbs) , ((struct tcp_pcb *)lpcb) );
  return (struct tcp_pcb *)lpcb;
}






----- Original Message ----- 
From: "Paul Sheer" <address@hidden>
To: <address@hidden>
Cc: <address@hidden>; "Dirk Koopman" <address@hidden>
Sent: Wednesday, June 19, 2002 7:13 PM
Subject: Re: [lwip] uses struct member after free - bug


> not to mention
> 
> <  if(pcb == NULL) {
> >  if(lpcb == NULL) {
> 
> and then there is also
> 
> <  if(tcp_input_pcb != pcb) {
> >  if(tcp_input_pcb == pcb) {
> 
> in tcp_output() (according to the comments)
> 
> -paul
> 
> On 2002.06.19 14:41 Duncan Palmer wrote:
> > I actually meant 'what source file is this in?' .  Xavier went and found it 
> > anyway, so its cool. 
> > 
> > This helped with a problem we were having as well - thanks.
> > 
> > On Wednesday 19 June 2002 11:35, Dirk Koopman wrote:
> > > On Wed, 2002-06-19 at 10:56, Duncan Palmer wrote:
> > > > Where is it??
> > > >
> > > > On Tuesday 18 June 2002 22:06, Paul Sheer wrote:
> > > > >   memp_free(MEMP_TCP_PCB, pcb);
> > > > >   lpcb->callback_arg = pcb->callback_arg;              <**********
> > > > >   lpcb->local_port = pcb->local_port;                  <**********
> > > > >   ip_addr_set(&lpcb->local_ip, &pcb->local_ip);        <**********
> > > > > #if LWIP_CALLBACK_API
> > > > >   lpcb->accept = tcp_accept_null;
> > > > > #endif /* LWIP_CALLBACK_API */
> > > > >   TCP_REG((struct tcp_pcb **)&tcp_listen_pcbs, (struct tcp_pcb 
> > > > > *)lpcb);
> > > > >   return (struct tcp_pcb *)lpcb;
> > > > >
> > > > >
> > > > > just noticed this
> > > > >
> > > > > *wacks sinners fingers with 50cm wooden ruler*
> > > > >
> > > > > -paul
> > > > >
> > > > > Paul Sheer Consulting IT Services . . . Tel . . . +27 21 761 7224
> > > > > Email . . . address@hidden . . . . . . Pager . . . 088 0057245
> > > > > Linux development, cryptography, recruitment,  support,  training
> > > > > http://www.icon.co.za/~psheer . . . . http://rute.sourceforge.net
> > > > > L I N U X . . . . . . . . . . . .  The Choice of a GNU Generation
> > > > > [This message was sent through the lwip discussion list.]
> > > >
> > > > [This message was sent through the lwip discussion list.]
> > >
> > > [This message was sent through the lwip discussion list.]
> > [This message was sent through the lwip discussion list.]
> > 
> Paul Sheer Consulting IT Services . . . Tel . . . +27 21 761 7224
> Email . . . address@hidden . . . . . . Pager . . . 088 0057245
> Linux development, cryptography, recruitment,  support,  training
> http://www.icon.co.za/~psheer . . . . http://rute.sourceforge.net
> L I N U X . . . . . . . . . . . .  The Choice of a GNU Generation
> [This message was sent through the lwip discussion list.]
> 

[This message was sent through the lwip discussion list.]