[lwip-users] Zero-length pbuf

[Charles Landau]

In lwIP version 1.3.0, in core/tcp_out.c, starting at line 336 the code 
appends the pbuf chain queue->p to the unsent queue useg. When so doing 
it removes the TCP header from queue->p because useg already has a header.

It can happen that the pbuf chain queue->p is a chain of two (or more) 
pbufs, the first of which has only a TCP header (added at line 258). 
Removing the TCP header leaves this pbuf with a zero length. Appending 
this to useg using pbuf_cat() leaves the zero length pbuf in the chain. 
This leaves a useless zero length pbuf allocated and taking up space 
limited by TCP_SND_QUEUELEN.

I suggest in this case the zero length pbuf should be freed and only the 
rest of its chain appended to useg.