[lwip-devel] [bug #64458] When tcp_err() is invoked, tcp_pcb is freed but httpd_post_finished() is not called by httpd.c

[Hungyin Chang]

URL:
  <https://savannah.nongnu.org/bugs/?64458>

                 Summary: When tcp_err() is invoked, tcp_pcb is freed but
httpd_post_finished() is not called by httpd.c
                   Group: lwIP - A Lightweight TCP/IP stack
               Submitter: zlk1214
               Submitted: Sun 23 Jul 2023 10:59:22 AM UTC
                Category: apps
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: 2.1.3


    _______________________________________________________

Follow-up Comments:


-------------------------------------------------------
Date: Sun 23 Jul 2023 10:59:22 AM UTC By: Hungyin Chang <zlk1214>
When tcp_err() is invoked, tcp_pcb is freed but httpd_post_finished() is not
called by httpd.c

When LWIP_HTTPD_SUPPORT_POST=1, the user can implement the following three
functions to receive POST requests from the browser.
err_t httpd_post_begin(void *connection, const char *uri, const char
*http_request,
                       u16_t http_request_len, int content_len, char
*response_uri,
                       u16_t response_uri_len, u8_t *post_auto_wnd);
err_t httpd_post_receive_data(void *connection, struct pbuf *p);
void httpd_post_finished(void *connection, char *response_uri, u16_t
response_uri_len);

If memory is allocated in httpd_post_begin(), then it should be freed in
httpd_post_finished().
However, when tcp_err() event happens, http_err() in httpd.c does NOT call
httpd_post_finished(). Therefore, the memory cannot be freed, casuing memory
leak.

altcp_err(pcb, http_err);
/**

    The pcb had an error and is already deallocated.
    The argument might still be valid (if != NULL).

 */
static void
http_err(void *arg, err_t err)
{
  struct http_state hs = (struct http_state )arg;
  LWIP_UNUSED_ARG(err);

  LWIP_DEBUGF(HTTPD_DEBUG, ("http_err: %s\n", lwip_strerr(err)));

  if (hs != NULL) {
    http_state_free(hs);
  }
}

In my opinion, httpd_post_finished() should be called in http_err(), though
struct altcp_pcb has been freed at the time.







    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?64458>

_______________________________________________
Message sent via Savannah
https://savannah.nongnu.org/