Re: [lwip-users] Possible SNTP bug

[Bernhard 'Gustl' Bauer]

Hi Åke,

good to know I'm not the only one with this problem.

I'm not sure if we need to remove the pcb. I think an incoming UDP 
packet would allocate its own pbuf's.

Inside sntp_send_request() p is only a local pointer. It is not stored 
anywhere. It is only transmitted to udp_sendto() and then to 
udp_sendto_if(), where I cannot find any storing command either. So 
after sntp_send_request() is finished no one knows of this pbuf and it 
cannot be freed.

I searched for other appearances of udp_sendto() and found one in 
dns_send():

    /* send dns packet */
    err = udp_sendto(dns_pcb, p, &dns_servers[numdns], DNS_SERVER_PORT);

    /* free pbuf */
    pbuf_free(p);

Maybe we can free pbuf right after calling udp_sendto()?

Gustl

Am 29.08.2011 14:04, schrieb address@hidden:
> Hi,
>
> The (possible) bug is present in 1.4.0 as well, I sent a mail about it
> just yesterday. My guess is that the best way to go about this is to
> free the pbuf during retry. To do that safely I think we need to remove
> the pcb using udp_remove(pcb) aswell since the server might still send a
> response and if we don't remove the pcb it will try to store data in a
> pbuf that no longer exist.
>
> To do this we should prefrebly send the pcb with the timeout to
> smtp_retry() somehow.
>
> Note that this is just guesses and assumptions, I don't know the system
> good enought to be sure of anything I say... I'll do some tests this
> week and see if I can get something working. If you manage to patch the
> problem in the meantime I'd be glad if you'd share your fix with me.
>
> Best Regards
> /Åke
> -----------------------------
> Åke Forslund
> 0433-273296
> NIBE AB
> Box 14
> S-285 21 Markaryd
> Tel +46-(0)433-273296
>
>
>
> From:   "Bernhard 'Gustl' Bauer" <address@hidden>
> To:     Mailing list for lwIP users <address@hidden>
> Date:   2011-08-29 13:38
> Subject:        [lwip-users] Possible SNTP bug
> Sent by:        address@hidden
>
>
> ------------------------------------------------------------------------
>
>
>
> Hi,
>
> I'm using lwip 1.3, NO_SYS. I know it is not up to date, but the contrib
> 1.4 for sntp has not changed much since 1.3 and I checked the differences.
>
> My problem is: the HEAP has an overflow when the time server could not
> be reached. The pbuf_alloc() in sntp_send_request() has no matching
> pbuf_free() in this case. The only pbuf_free() I found is in
> sntp_recv(), so pbuf can only be freed when there is an answer.
> sntp_send() is called repeatedly by sntp_retry().
>
> Even when the time server can be reached there is a slight increase in
> used HEAP space. But this could be dropped packets which would have the
> same effect due to the above error.
>
> I can think of 2 solutions: Use always the same pbuf, or free it during
> sntp_retry. Some pointers how to do this the right way would be great.
>
> TIA
>
> Gustl
>
>
> _______________________________________________
> lwip-users mailing list
> address@hidden
> https://lists.nongnu.org/mailman/listinfo/lwip-users
>
>
>
>
> _______________________________________________
> lwip-users mailing list
> address@hidden
> https://lists.nongnu.org/mailman/listinfo/lwip-users