[lwip-users] [lwip] uIP tapdev_send() again

[Felipe Massia]

Hello!

In unix/tapdev.c:tapdev_send():
   140    iov[0].iov_base = uip_buf;
   141    iov[0].iov_len = 40 + UIP_LLH_LEN;
   142    iov[1].iov_base = (char *)uip_appdata;
   143    iov[1].iov_len = uip_len - 40 + UIP_LLH_LEN;

should not be (untested code :-)
   141    iov[0].iov_len = (uip_len < 40 + UIP_LLH_LEN) ? uip_len : (40 +
UIP_LLH_LEN);
...
   143    iov[1].iov_len = uip_len - (40 + UIP_LLH_LEN);
?

It could send some invalid data of size 2*UIP_LLH_LEN. And sometimes
uip_len is less than 40+UIP_LLH_LEN (arp replies, 42 bytes). But this is
not a problem because writev() won't write the second iov since iov_len
is negative.

As I'm using the alternative implementation for writev() (writev
misbehaves with my tap driver) I'm just predicting what would happen.

[]s
--
Felipe
[This message was sent through the lwip discussion list.]