[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[lwip-devel] [bug #28049] Keep Alive timeout frees pcb then uses it, so
From: |
Mike |
Subject: |
[lwip-devel] [bug #28049] Keep Alive timeout frees pcb then uses it, sometimes causing crash error. |
Date: |
Wed, 18 Nov 2009 22:24:47 +0000 |
User-agent: |
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) |
URL:
<http://savannah.nongnu.org/bugs/?28049>
Summary: Keep Alive timeout frees pcb then uses it,
sometimes causing crash error.
Project: lwIP - A Lightweight TCP/IP stack
Submitted by: mikeredd
Submitted on: Wed 18 Nov 2009 10:24:46 PM GMT
Category: TCP
Severity: 3 - Normal
Item Group: Crash Error
Status: None
Privacy: Public
Assigned to: None
Open/Closed: Open
Discussion Lock: Any
Planned Release:
lwIP version: 1.3.1
_______________________________________________________
Details:
Inside of tcp_slowtmr(), when a keepalive timeout occurs, tcp_abort() is
called for the pcb. This frees the pcb.
The pcb pointer remains, however, and "pcb = pcb->next" is called at the end
of the loop. This causes crash sometimes (because memory can be reallocated
during the sending of the RST)and is very tifficult to trace.
Here is a fix (it is also attached):
----- tcp.c (old), line 669 -----
tcp_abort(pcb);
----- tcp.c (new), line 669-672 -----
pcb2 = pcb->next;
tcp_abort(pcb);
pcb = pcb2;
continue;
-----
_______________________________________________________
File Attachments:
-------------------------------------------------------
Date: Wed 18 Nov 2009 10:24:46 PM GMT Name: tcp.c Size: 42kB By: mikeredd
<http://savannah.nongnu.org/bugs/download.php?file_id=19079>
_______________________________________________________
Reply to this item at:
<http://savannah.nongnu.org/bugs/?28049>
_______________________________________________
Message sent via/by Savannah
http://savannah.nongnu.org/
- [lwip-devel] [bug #28049] Keep Alive timeout frees pcb then uses it, sometimes causing crash error.,
Mike <=