[lwip-devel] [bug #49744] pppos_connect() zeroes in_head and in_tail, possibly causing a memory leak.

[Art Heers]

URL:
  <http://savannah.nongnu.org/bugs/?49744>

                 Summary: pppos_connect() zeroes in_head and in_tail, possibly
causing a memory leak.
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: artheers
            Submitted on: Wed 30 Nov 2016 08:19:16 PM GMT
                Category: PPP
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: 2.0.0

    _______________________________________________________

Details:

pppos_input() can call ppp_input() which can call pppos_disconnect() to
disconnect the interface.  However, it will continue to read in characters and
allocate a pbuf from the PBUF_POOL and keep it in pppos->in_head and in_tail. 
When a re-connect happens and pppos_connect() is called, this pppos->in_head
and in_tail are zeroed, hence a memory leak.  (This happens with
PPP_INPROC_IRQ_SAFE not defined.)

A fix would be inside pppos_input() to break out of the loop inputting
characters after calling ppp_input() if pppos->open == 0.  Note that the loop
is not even entered if pppos->open == 0.

          ppp_input(ppp, inp);
          if(pppos->open == 0) //get out if they disconnected
            break;





    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?49744>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/