[lwip-devel] [bug #57377] Assertion "pbuf_free: p->ref > 0" failed

[Erik Ekman]

Follow-up Comment #2, bug #57377 (project lwip):

By disabling LWIP_RAND_FOR_FUZZ I got some of them to fail:
$ for i in `ls crashed_inputs/*`; do ./triple_fuzz $i ; echo $?; done
Reading input from file... testing file: "crashed_inputs/001"...
0
Reading input from file... testing file: "crashed_inputs/002"...
0
Reading input from file... testing file: "crashed_inputs/003"...
0
Reading input from file... testing file: "crashed_inputs/004"...
Assertion "mss_local is too small" failed at line 486 in
../../src/core/tcp_out.c
Aborted (core dumped)
134
Reading input from file... testing file: "crashed_inputs/005"...
Assertion "inconsistent oversize vs. space" failed at line 504 in
../../src/core/tcp_out.c
Aborted (core dumped)
134
Reading input from file... testing file: "crashed_inputs/006"...
Assertion "pbuf_free: p->ref > 0" failed at line 753 in ../../src/core/pbuf.c
Aborted (core dumped)
134
Reading input from file... testing file: "crashed_inputs/007"...
Assertion "tcp_slowtimr: persist ticking with empty send buffer" failed at
line 1241 in ../../src/core/tcp.c
Aborted (core dumped)
134
Reading input from file... testing file: "crashed_inputs/008"...
Assertion "Can't split segment into length 0" failed at line 851 in
../../src/core/tcp_out.c
Aborted (core dumped)
134
Reading input from file... testing file: "crashed_inputs/009"...
0

    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?57377>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/