[lwip-devel] [bug #48539] Possible crash when packet received in SYN_SENT state

[Ambroz Bizjak]

Follow-up Comment #2, bug #48539 (project lwip):

Hi Simon,
Just letting you know that in my fork I have refactored the TX code to only
use a single queue. That simplifies a bunch of things. Commit:
https://github.com/ambrop72/aprinter/commit/372998a262ad729590b3a88f1581022eedd4cd34

Basically I have:
pcb->sndq - the front of the one send queue, always ordered
pcb->sndq_last - last element, removes need to search for the last segment in
various places
pcb->sndq_next - next segment to be sent by tcp_output()

For the fast retransmission which used to move a single segment from ->unacked
to ->unsent, I just set a flag in pcb->flags which forces tcp_output() to
output the first segment in sndq regardless of sndq->next.

As far as this particular issue is concerned, I think it is also an option to
check "ackno == (u32_t)(pcb->lastack + 1)" instead of looking at the segments
but still care is needed a bit later on when freeing the segment.

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?48539>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/