[lwip-devel] [bug #57377] Assertion "pbuf_free: p->ref > 0" failed

[Erik Ekman]

Follow-up Comment #7, bug #57377 (project lwip):

Using latest git code:

$ cd test/fuzz
$ make all D="-DLWIP_RAND_FOR_FUZZ_SIMULATE_GLIBC"
$ for i in `ls crashed_inputs/*`; do ./lwip_fuzz3 $i; done
reading input from file... testing file: "crashed_inputs/001"...
reading input from file... testing file: "crashed_inputs/002"...
reading input from file... testing file: "crashed_inputs/003"...
reading input from file... testing file: "crashed_inputs/004"...
Assertion "mss_local is too small" failed at line 486 in
../../src/core/tcp_out.c
Aborted (core dumped)
reading input from file... testing file: "crashed_inputs/005"...
Assertion "inconsistent oversize vs. space" failed at line 504 in
../../src/core/tcp_out.c
Aborted (core dumped)
reading input from file... testing file: "crashed_inputs/006"...
reading input from file... testing file: "crashed_inputs/007"...
Assertion "tcp_slowtimr: persist ticking with empty send buffer" failed at
line 1241 in ../../src/core/tcp.c
Aborted (core dumped)
reading input from file... testing file: "crashed_inputs/008"...
Assertion "Can't split segment into length 0" failed at line 851 in
../../src/core/tcp_out.c
Aborted (core dumped)
reading input from file... testing file: "crashed_inputs/009"...

So after this one was fixed (006) there are still 4 left that crash. I am not
familiar with the tcp code so I am not sure if I can fix them.

    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?57377>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/