[lwip-devel] [patch #10121] bug: httpd creates circular linked list that causes an infinite loop

[Peter Lawrence]

URL:
  <https://savannah.nongnu.org/patch/?10121>

                 Summary: bug: httpd creates circular linked list that causes
an infinite loop
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: majbthrd
            Submitted on: Wed 13 Oct 2021 09:52:03 PM UTC
                Category: Contrib
                Priority: 6
                  Status: None
                 Privacy: Public
             Assigned to: None
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None

    _______________________________________________________

Details:

This pertains to the httpd service in ./src/apps/http/httpd.c

Unless the user has specifically overridden the normally enabled
LWIP_HTTPD_SUPPORT_REQUESTLIST, the right input sequence will cause httpd to
go into an infinite loop.

To reproduce, telnet to the httpd service port and press the ENTER key twice.

What I observe is that this test procedure results in two calls to the httpd
handler with the same pbuf pointer.  In the code below the comment "enqueue
the pbuf", there is a call to pbuf_cat() to concatenate the existing pbuf to
itself, and in the later pbuf_len() call will then proceed to count this
circular linked list for the rest of time.




    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Wed 13 Oct 2021 09:52:03 PM UTC  Name: httpd.diff  Size: 483B   By:
majbthrd

<http://savannah.nongnu.org/patch/download.php?file_id=52096>

    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/patch/?10121>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/