[lwip-users] possible bug in sys_timeout()

[John Taylor]

There appears to be bug in the sys_timeout() code at line 40 below.  Is
it pilot error on my part or a real bug?

To exit the for-loop at line 32, the if statement at line 34 must
evaluate to true.  When the IF statement is true then "t->next == NULL"
or "t->next->time > timeout->time" is true. BUT if "t->next == NULL"
then I should crash at line 40.

>From version 0.7.0
===================
 1:     void
 2:     sys_timeout(u32_t msecs, sys_timeout_handler h, void *arg)
 3:     {
 4:       struct sys_timeouts *timeouts;
 5:       struct sys_timeout *timeout, *t;
 6:
 7:       timeout = memp_malloc(MEMP_SYS_TIMEOUT);
 8:       if (timeout == NULL) {
 9:         return;
10:       }
11:       timeout->next = NULL;
12:       timeout->h = h;
13:       timeout->arg = arg;
14:       timeout->time = msecs;
15:
16:       timeouts = sys_arch_timeouts();
17:
18:       LWIP_DEBUGF(SYS_DEBUG, ("sys_timeout: %p msecs=%lu h=%p
arg=%p\n",
19:         (void *)timeout, msecs, (void *)h, (void *)arg));
20:
21:       LWIP_ASSERT("sys_timeout: timeouts != NULL", timeouts !=
NULL);
22:       if (timeouts->next == NULL) {
23:         timeouts->next = timeout;
24:         return;
25:       }
26:
27:       if (timeouts->next->time > msecs) {
28:         timeouts->next->time -= msecs;
29:         timeout->next = timeouts->next;
30:         timeouts->next = timeout;
31:       } else {
32:         for(t = timeouts->next; t != NULL; t = t->next) {
33:           timeout->time -= t->time;
34:           if (t->next == NULL ||
35:        t->next->time > timeout->time) {
36:       if (t->next != NULL) {
37:         t->next->time -= timeout->time;
38:       }
39:       timeout->next = t->next;
40:       t->next = timeout;
41:       break;
42:           }
43:         }
44:       }
45:
46:     }
47:


John T. Taylor
Shift-Right Technologies, LLC.
433 Comanche Trl
Lawrenceville, GA 30044
Tel: 678-344-3115
Fax: 770-736-9276
email: address@hidden
url: www.shift-right.com