[lwip-devel] [bug #57790] Fragmented UDP packets leads to crash on reassembly

[Benjamin K]

Follow-up Comment #13, bug #57790 (project lwip):

Mentioning threading requirement is a good point, I will check that in detail.
But I think I found at least one issue in my source:

In my interface  low level input method:

struct pbuf* p = pbuf_alloc(PBUF_RAW, Msg->Size, PBUF_REF);

if (p != NULL) {
        p->payload = GetPayloadBuffer(Msg);
        p->len = Msg->Size;
        if (Interface->input(p, Interface) != ERR_OK ) {
                pbuf_free(p); // On fail, we have to free the buffer
        } else {
                CallbackResult = 1;
                // buffer is already freed internally
        }
}

My Msg was actually a stack variable, I was assuming that Interface->input()
was blocking and that after that call the content of that stack variable gets
cloned. However this isn't the case especially with PBUF_REF set.

    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?57790>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/