[lwip-users] Bug in netconn_peer(): checking uninitialized udp pc b

[Vlahovic, Donald]

There is a bug in netconn_peer():

When calling lwip_socket() in an application a netconnection is created and
conn->pcb.tcp is set to NULL.

In next step the application calls lwip_sendto() which checks in
netconn_peer() if the PCB is connected. For UDP the flag UDP_FLAGS_CONNECTED
in conn->pcb.udp->flags is checked. Now when the connection is new and
conn->pcb.tcp is NULL, the UDP PCB is not initialized, but ERR_OK is
returned under some circumstances so lwip_sendto() sets connected to 1.

To prevent this we could check if conn->pcb.tcp is NULL before processing
the switch command and return -1 in this case:

err_t
netconn_peer(struct netconn *conn, struct ip_addr *addr,
             u16_t *port)
{
  if(conn->pcb.tcp == NULL)
   return -1;

  switch(conn->type) {
  ...

Bug submission is here: 

http://savannah.nongnu.org/bugs/?func=detailbug&bug_id=2943&group_id=3159


Donald Vlahovic