mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-11-19 05:10:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

checked in patch #5796: pbuf_alloc: len field claculation caused memory corruption.

Browse Source
This commit is contained in:
goldsimon 2007-03-11 20:07:37 +00:00
parent 1af676385c
commit 3bb13829fe
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG
View File

@ -67,6 +67,10 @@ HISTORY
++ Bug fixes: ++ Bug fixes:
2007-03-11 Simon Goldschmidt
* pbuf.c: checked in patch #5796: pbuf_alloc: len field claculation caused
memory corruption.
2007-03-11 Simon Goldschmidt (based on patch from Dmitry Potapov) 2007-03-11 Simon Goldschmidt (based on patch from Dmitry Potapov)
* api_lib.c, sockets.c, api.h, api_msg.h, sockets.h: Fixed bug #19251 * api_lib.c, sockets.c, api.h, api_msg.h, sockets.h: Fixed bug #19251
(missing `const' qualifier in socket functions), to get more compatible to (missing `const' qualifier in socket functions), to get more compatible to

4
src/core/pbuf.c
View File

@ -102,6 +102,8 @@ pbuf_init(void)
pbuf_pool = (struct pbuf *)MEM_ALIGN(pbuf_pool_memory); pbuf_pool = (struct pbuf *)MEM_ALIGN(pbuf_pool_memory);
LWIP_ASSERT("pbuf_init: sizeof(struct pbuf) must be a multiple of MEM_ALIGNMENT",
(sizeof(struct pbuf) % MEM_ALIGNMENT) == 0);
LWIP_ASSERT("pbuf_init: PBUF_POOL_BUFSIZE not aligned", LWIP_ASSERT("pbuf_init: PBUF_POOL_BUFSIZE not aligned",
(PBUF_POOL_BUFSIZE % MEM_ALIGNMENT) == 0); (PBUF_POOL_BUFSIZE % MEM_ALIGNMENT) == 0);
@ -261,7 +263,7 @@ pbuf_alloc(pbuf_layer l, u16_t length, pbuf_flag flag)
/* the total length of the pbuf chain is the requested size */ /* the total length of the pbuf chain is the requested size */
p->tot_len = length; p->tot_len = length;
/* set the length of the first pbuf in the chain */ /* set the length of the first pbuf in the chain */
p->len = length > PBUF_POOL_BUFSIZE - offset? PBUF_POOL_BUFSIZE - offset: length; p->len = length > PBUF_POOL_BUFSIZE - MEM_ALIGN_SIZE(offset)? PBUF_POOL_BUFSIZE - MEM_ALIGN_SIZE(offset): length;
/* set reference count (needed here in case we fail) */ /* set reference count (needed here in case we fail) */
p->ref = 1; p->ref = 1;