[lwip-devel] [bug #24032] pbuf realloc wander over the end of a linked list

[Jonathan Larmour]

Update of bug #24032 (project lwip):

                  Status:                    None => Need Info              
             Assigned to:                    None => jifl                   

    _______________________________________________________

Follow-up Comment #1:

I don't think this patch seems right.

For the first chunk of the patch, this could only help if the pbuf chain was
already corrupted. In other words, the real problem is elsewhere. If q is
NULL, that can only mean either:
a) pbuf_realloc was called with a NULL pbuf; or
b) the sum of the 'len' fields for all the pbufs in the pbuf chain did not
match p->tot_len.

For the second chunk, this is converting an error which should be caught at
development time, to a soft error which returns more cleanly and is included
in all code. But this sort of problem should be caught by developers as it
implies the caller of pbuf_header() has done something incorrect - you should
never be trying to take more bytes from the pbuf than could be there. Maybe,
again, the reason you saw this is because your pbuf chains were already
corrupted.

Unfortunately I think all you've done is mask some corruption.

I'll wait for your reply and give you the benefit of the doubt, rather than
closing straight away, so let me know your view.

Jifl


    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?24032>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/