[lwip-users] Sys.c bug

[Nicolas Pinault]

Hi all,

I have the following :
- 2 tasks that use a socket each in server mode.
- System starts up : ok
- Each task waits for a connection (accept) : ok
- Connections are established by a client : ok
- Both connections are stopped by client : ok
- Both tasks close connection and wait for another connection (accept): ok
- After 70 seconds the system crashes because of a NULL pointer access.
- If a client reconnects before 70sec, it is ok.
- When connection is closed, the system crashes 70sec after the 
connection has been closed (task are waiting for a connection).

All versions of lwip are concerned.
I am currently using lwip V1.2.0

I have solved the problem by modifying sys_mbox_fetch function in sys.c 
module :

.
.
.
   if (time == SYS_ARCH_TIMEOUT) {
     /* If time == SYS_ARCH_TIMEOUT, a timeout occured before a message
  could be fetched. We should now call the timeout handler and
  deallocate the memory allocated for the timeout. */
     tmptimeout = timeouts->next;
     if (tmptimeout != NULL)                           /* ADDED */
     {
       timeouts->next = tmptimeout->next;
       h = tmptimeout->h;
       arg = tmptimeout->arg;
       memp_free(MEMP_SYS_TIMEOUT, tmptimeout);
       if (h != NULL) {
         LWIP_DEBUGF(SYS_DEBUG, ("smf calling h=%p(%p)\n", (void *)h, 
(void *)arg));
           h(arg);
       }
     }
     /* We try again to fetch a message from the mbox. */
     goto again;
   } else {
.
.
.

I'm afraid this hides a more serious problem.

Nicolas