[lwip-users] [lwip] TCP ack segment versus OOSEQ handling

[Andy Valencia]

Hi,

We're seeing a problem with the OOSEQ code when a packet with no
payload comes in.  Consider the case where:

        if(inseg.p->tot_len > 0) {
          pcb->recv_data = inseg.p;
          /* Since this pbuf now is the responsibility of the
             application, we delete our reference to it so that we won't
             (mistakingly) deallocate it. */
          inseg.p = NULL;
        }

has in fact a tot_len of 0, thus pcb->recv_data remains NULL.

Now in the OOSEQ handling, the code sequence at:

          if(cseg->p->tot_len > 0) {
            /* Chain this pbuf onto the pbuf that we will pass to
               the application. */
            pbuf_chain(pcb->recv_data, cseg->p);
            cseg->p = NULL;
          }

seems to conflict with this, since it'll try to concatenate onto a NULL
pointer, corresponding to a packet with no data.  We get a segv here since
we're lucky enough to be under an MMU.

Does this scenario make sense to anybody else?  Or have I botched
something in my port?

Thanks,
Andy Valencia
address@hidden
[This message was sent through the lwip discussion list.]