Re: [lwip-users] Can serve only short webpages

[address@hidden]

On 03.03.2018 23:30, JM wrote:

So now the only entry into lwIP is through low_level_input(). I've spent a good deal of time trying to debug this and where I got stuck was in  tcp_receive() where it calls pbuf_clen(), which returns MEMP_NUM_PBUF and that's where the underflow originates. If I look at the pbuf passed into pbuf_clen() it does indeed have all pbufs in existence chained to it. I can't understand where this occurred however.

I guess this is because the pbuf you see is actually freed. The 'next' pointer of a pbuf just happens to be the same place as in the list of free element in a mem pool.

To me it seems like a "use after free" bug.

Simon