[lwip-devel] Corrupt pppos_pcb in pppos_create function

[Wayne Uroda]

Hi,

This is my first post so I apologise if this is not the right mailing list.

I am using the latest GIT version of the code cloned from here

git://git.savannah.nongnu.org/lwip.git

When I create a new PPP connection, I am seeing a hardfault (segfault) coming from pbuf_free.

I traced the problem to an invalid in_head field of the pppos_pcb structure.

The field is invalid because the memory is never cleared to zero after the pppos_pcb structure is created in pppos_create().

I was able to fix the issue by adding a memset after the memp_malloc call.

I have attached a patch file showing this.

Is this correct? Should memp_malloc instead return zero-initialised memory? I don't believe so from what I have read of the source code but can't find any explicit documentation on that point.

Thanks

- Wayne

pppos.c.patch
Description: Binary data