While doing testing I found bug in tcp_out.c.
/* If total number of pbufs on the unsent/unacked queues exceeds the
* configured maximum, return an error */
queuelen = pcb->snd_queuelen;
if (queuelen >= TCP_SND_QUEUELEN) {
LWIP_DEBUGF(TCP_OUTPUT_DEBUG | 3, ("tcp_enqueue: too long queue %u
(max %u)\n", queuelen, TCP_SND_QUEUELEN));
goto memerr;
}
should be (because queue is not initialized and used in memerr):
/* If total number of pbufs on the unsent/unacked queues exceeds the
* configured maximum, return an error */
queuelen = pcb->snd_queuelen;
if (queuelen >= TCP_SND_QUEUELEN) {
LWIP_DEBUGF(TCP_OUTPUT_DEBUG | 3, ("tcp_enqueue: too long queue %u
(max %u)\n", queuelen, TCP_SND_QUEUELEN));
return ERR_MEM;
}