mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-11-18 20:10:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

udp_input(): Input pbuf was not freed if pcb had no recv function registered, p->payload was modified without modifying p->len if sending icmp_dest_unreach() (had no negative effect but was definitively wrong).

Browse Source
This commit is contained in:
goldsimon 2007-06-03 11:32:03 +00:00
parent 75fd6fc4a4
commit 974cf08e5d
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
CHANGELOG
View File

@ -170,6 +170,11 @@ HISTORY
++ Bug fixes: ++ Bug fixes:
2007-06-03 Simon Goldschmidt
* udp.c: udp_input(): Input pbuf was not freed if pcb had no recv function
registered, p->payload was modified without modifying p->len if sending
icmp_dest_unreach() (had no negative effect but was definitively wrong).
2007-06-03 Simon Goldschmidt 2007-06-03 Simon Goldschmidt
* icmp.c: Corrected bug #19937: For responding to an icmp echo request, icmp * icmp.c: Corrected bug #19937: For responding to an icmp echo request, icmp
re-used the input pbuf even if that didn't have enough space to include the re-used the input pbuf even if that didn't have enough space to include the

11
src/core/udp.c
View File

@ -214,8 +214,14 @@ udp_input(struct pbuf *p, struct netif *inp)
if (pcb != NULL) { if (pcb != NULL) {
snmp_inc_udpindatagrams(); snmp_inc_udpindatagrams();
/* callback */ /* callback */
if (pcb->recv != NULL) if (pcb->recv != NULL) {
/* now the recv function is responsible for freeing p */
pcb->recv(pcb->recv_arg, pcb, p, &(iphdr->src), src); pcb->recv(pcb->recv_arg, pcb, p, &(iphdr->src), src);
} else {
/* no recv function registered? then we have to free the pbuf! */
pbuf_free(p);
goto end;
}
} else { } else {
LWIP_DEBUGF(UDP_DEBUG | LWIP_DBG_TRACE, ("udp_input: not for us.\n")); LWIP_DEBUGF(UDP_DEBUG | LWIP_DBG_TRACE, ("udp_input: not for us.\n"));
@ -226,7 +232,8 @@ udp_input(struct pbuf *p, struct netif *inp)
!ip_addr_ismulticast(&iphdr->dest)) { !ip_addr_ismulticast(&iphdr->dest)) {
/* restore pbuf pointer */ /* restore pbuf pointer */
p->payload = iphdr; pbuf_header(p, (IPH_HL(iphdr) * 4));
LWIP_ASSERT("p->payload == iphdr", (p->payload == iphdr));
icmp_dest_unreach(p, ICMP_DUR_PORT); icmp_dest_unreach(p, ICMP_DUR_PORT);
} }
UDP_STATS_INC(udp.proterr); UDP_STATS_INC(udp.proterr);