[lwip-devel] [bug #50090] last_unsent->oversize_left can become wrong value in tcp_write error path

[Axel Lin]

URL:
  <http://savannah.nongnu.org/bugs/?50090>

                 Summary: last_unsent->oversize_left can become wrong value in
tcp_write error path
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: axellin
            Submitted on: Thu 19 Jan 2017 10:27:37 AM GMT
                Category: TCP
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: 2.0.0

    _______________________________________________________

Details:

In Phase2: Chain a new pbuf to the end of pcb->unsent.
 492     if ((pos < len) && (space > 0) && (last_unsent->len > 0)) {
 493       u16_t seglen = LWIP_MIN(space, len - pos);
 494       seg = last_unsent;
 495
 496       /* Create a pbuf with a copy or reference to seglen bytes. We
 497        * can use PBUF_RAW here since the data appears in the middle of
 498        * a segment. A header will never be prepended. */
 499       if (apiflags & TCP_WRITE_FLAG_COPY) {
 500         /* Data is copied */
 501         if ((concat_p = tcp_pbuf_prealloc(PBUF_RAW, seglen, space,
&oversize, pcb, apiflags, 1)) == NULL) {
 502           LWIP_DEBUGF(TCP_OUTPUT_DEBUG | LWIP_DBG_LEVEL_SERIOUS,
 503                       ("tcp_write : could not allocate memory for pbuf
copy size %"U16_F"\n",
 504                        seglen));
 505           goto memerr;
 506         }
 507 #if TCP_OVERSIZE_DBGCHECK
 508         last_unsent->oversize_left += oversize;
 509 #endif /* TCP_OVERSIZE_DBGCHECK */

last_unsent->oversize_left is already updated in line 508.

If Phase 3: Create new segments fails in any goto memerr path,
last_unsent->oversize_left becomes wrong.





    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?50090>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/