[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[lwip-users] Re: [lwip] uses struct member after free - bug
From: |
Xavier Hanin |
Subject: |
[lwip-users] Re: [lwip] uses struct member after free - bug |
Date: |
Thu, 09 Jan 2003 01:17:33 -0000 |
Thanks Paul for having spotted this one as well!
As a conclusion for the last 2 bugs in tcp_listen (src/core/tcp.c) , here's the
fix.
Xavier.
struct tcp_pcb *
tcp_listen(struct tcp_pcb *pcb)
{
struct tcp_pcb_listen *lpcb;
lpcb = memp_malloc(MEMP_TCP_PCB_LISTEN);
if(lpcb == NULL) {
return NULL;
}
lpcb->callback_arg = pcb->callback_arg;
lpcb->local_port = pcb->local_port;
ip_addr_set(&lpcb->local_ip, &pcb->local_ip);
memp_free(MEMP_TCP_PCB, pcb);
#if LWIP_CALLBACK_API
lpcb->accept = tcp_accept_null;
#endif /* LWIP_CALLBACK_API */
TCP_REG( ((struct tcp_pcb **)&tcp_listen_pcbs) , ((struct tcp_pcb *)lpcb) );
return (struct tcp_pcb *)lpcb;
}
----- Original Message -----
From: "Paul Sheer" <address@hidden>
To: <address@hidden>
Cc: <address@hidden>; "Dirk Koopman" <address@hidden>
Sent: Wednesday, June 19, 2002 7:13 PM
Subject: Re: [lwip] uses struct member after free - bug
> not to mention
>
> < if(pcb == NULL) {
> > if(lpcb == NULL) {
>
> and then there is also
>
> < if(tcp_input_pcb != pcb) {
> > if(tcp_input_pcb == pcb) {
>
> in tcp_output() (according to the comments)
>
> -paul
>
> On 2002.06.19 14:41 Duncan Palmer wrote:
> > I actually meant 'what source file is this in?' . Xavier went and found it
> > anyway, so its cool.
> >
> > This helped with a problem we were having as well - thanks.
> >
> > On Wednesday 19 June 2002 11:35, Dirk Koopman wrote:
> > > On Wed, 2002-06-19 at 10:56, Duncan Palmer wrote:
> > > > Where is it??
> > > >
> > > > On Tuesday 18 June 2002 22:06, Paul Sheer wrote:
> > > > > memp_free(MEMP_TCP_PCB, pcb);
> > > > > lpcb->callback_arg = pcb->callback_arg; <**********
> > > > > lpcb->local_port = pcb->local_port; <**********
> > > > > ip_addr_set(&lpcb->local_ip, &pcb->local_ip); <**********
> > > > > #if LWIP_CALLBACK_API
> > > > > lpcb->accept = tcp_accept_null;
> > > > > #endif /* LWIP_CALLBACK_API */
> > > > > TCP_REG((struct tcp_pcb **)&tcp_listen_pcbs, (struct tcp_pcb
> > > > > *)lpcb);
> > > > > return (struct tcp_pcb *)lpcb;
> > > > >
> > > > >
> > > > > just noticed this
> > > > >
> > > > > *wacks sinners fingers with 50cm wooden ruler*
> > > > >
> > > > > -paul
> > > > >
> > > > > Paul Sheer Consulting IT Services . . . Tel . . . +27 21 761 7224
> > > > > Email . . . address@hidden . . . . . . Pager . . . 088 0057245
> > > > > Linux development, cryptography, recruitment, support, training
> > > > > http://www.icon.co.za/~psheer . . . . http://rute.sourceforge.net
> > > > > L I N U X . . . . . . . . . . . . The Choice of a GNU Generation
> > > > > [This message was sent through the lwip discussion list.]
> > > >
> > > > [This message was sent through the lwip discussion list.]
> > >
> > > [This message was sent through the lwip discussion list.]
> > [This message was sent through the lwip discussion list.]
> >
> Paul Sheer Consulting IT Services . . . Tel . . . +27 21 761 7224
> Email . . . address@hidden . . . . . . Pager . . . 088 0057245
> Linux development, cryptography, recruitment, support, training
> http://www.icon.co.za/~psheer . . . . http://rute.sourceforge.net
> L I N U X . . . . . . . . . . . . The Choice of a GNU Generation
> [This message was sent through the lwip discussion list.]
>
[This message was sent through the lwip discussion list.]
- [lwip-users] Re: [lwip] uses struct member after free - bug, Dirk Koopman, 2003/01/08
- [lwip-users] Re: [lwip] uses struct member after free - bug, Duncan Palmer, 2003/01/08
- [lwip-users] Re: [lwip] uses struct member after free - bug, Duncan Palmer, 2003/01/08
- [lwip-users] Re: [lwip] uses struct member after free - bug, Paul Sheer, 2003/01/09
- [lwip-users] Re: [lwip] uses struct member after free - bug, Xavier Hanin, 2003/01/09
- [lwip-users] Re: [lwip] uses struct member after free - bug, Leon Woestenberg, 2003/01/09
- [lwip-users] Re: [lwip] uses struct member after free - bug,
Xavier Hanin <=