mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-10-04 05:39:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Check that pbuf_header succeeds in IPv6 reassembly.

Browse Source
This commit is contained in:
Ivan Delamer 2012-03-02 09:16:33 -07:00
parent 5c199483cd
commit 34531a8160
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/core/ipv6/ip6_frag.c
View File

@ -149,8 +149,12 @@ ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr)
p = ipr->p;
ipr->p = iprh->next_pbuf;
/* Then, move back to the original header (we are now pointing to Fragment header). */
pbuf_header(p, (u8_t*)p->payload - (u8_t*)ipr->iphdr);
icmp6_time_exceeded(p, ICMP6_TE_FRAG);
if (pbuf_header(p, (u8_t*)p->payload - (u8_t*)ipr->iphdr)) {
LWIP_ASSERT("ip6_reass_free: moving p->payload to ip6 header failed\n", 0);
}
else {
icmp6_time_exceeded(p, ICMP6_TE_FRAG);
}
clen = pbuf_clen(p);
LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
pbufs_freed += clen;
@ -490,9 +494,6 @@ ip6_reass(struct pbuf *p)
frag_hdr->_fragment_offset = 0;
frag_hdr->_identification = 0;
/* Move pbuf back to IPv6 header. */
pbuf_header(p, (u8_t*)p->payload - (u8_t*)ipr->iphdr);
/* release the sources allocate for the fragment queue entry */
if (reassdatagrams == ipr) {
/* it was the first in the list */
@ -504,9 +505,16 @@ ip6_reass(struct pbuf *p)
}
memp_free(MEMP_IP6_REASSDATA, ipr);
/* and adjust the number of pbufs currently queued for reassembly. */
/* adjust the number of pbufs currently queued for reassembly. */
ip6_reass_pbufcount -= pbuf_clen(p);
/* Move pbuf back to IPv6 header. */
if (pbuf_header(p, (u8_t*)p->payload - (u8_t*)ipr->iphdr)) {
LWIP_ASSERT("ip6_reass: moving p->payload to ip6 header failed\n", 0);
pbuf_free(p);
return NULL;
}
/* Return the pbuf chain */
return p;
}