[lwip-devel] [bug #64409] When tcp_err() is invoked, tcp_pcb is freed but fs_close_custom() is not called by httpd.c

[Hungyin Chang]

Follow-up Comment #2, bug #64409 (project lwip):

But the following problem does exist:

When tcp_err() is invoked, tcp_pcb is freed but httpd_post_finished() is not
called by httpd.c

When LWIP_HTTPD_SUPPORT_POST=1, the user can implement the following three
functions to receive POST requests from the browser.
err_t httpd_post_begin(void *connection, const char *uri, const char
*http_request,
                       u16_t http_request_len, int content_len, char
*response_uri,
                       u16_t response_uri_len, u8_t *post_auto_wnd);
err_t httpd_post_receive_data(void *connection, struct pbuf *p);
void httpd_post_finished(void *connection, char *response_uri, u16_t
response_uri_len);

If memory is allocated in httpd_post_begin(), then it should be freed in
httpd_post_finished().
However, when tcp_err() event happens, http_err() in httpd.c does NOT call
httpd_post_finished(). Therefore, the memory cannot be freed, casuing memory
leak.

altcp_err(pcb, http_err);
/**

    The pcb had an error and is already deallocated.
    The argument might still be valid (if != NULL).

 */
static void
http_err(void *arg, err_t err)
{
  struct http_state hs = (struct http_state )arg;
  LWIP_UNUSED_ARG(err);

  LWIP_DEBUGF(HTTPD_DEBUG, ("http_err: %s\n", lwip_strerr(err)));

  if (hs != NULL) {
    http_state_free(hs);
  }
}

In my opinion, httpd_post_finished() should be called in http_err(), though
struct altcp_pcb has been freed at the time.


    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?64409>

_______________________________________________
Message sent via Savannah
https://savannah.nongnu.org/