[lwip-devel] [bug #48543] TCP sent callback may prematurely report sent data when only part of a segment is acked

[Ambroz Bizjak]

Follow-up Comment #5, bug #48543 (project lwip):

I suppose there are some situations which could lead to a crash. Say the
segment is composed of multiple chained pbufs (due to multiple tcp_write
calls), and the application free()s the buffer referenced by the first pbuf
since the data has supposedly been acked. But lwip then tries to retransmit
the whole segment. On a platform with a free() that works with paging /
virtual memory, the freed data might actually become inaccessible causing a
crash.

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?48543>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/