[Ucip-devel] UDP BUG found in udpInput in netudp.c

[Mads C. <MC...@vo...>]

Hi everyone!

Please read this Robert.

Sorry about this. This is NOT a new bug to me but I never got around to =
reporting it.

In the udpInput function there are some memory leakage. This is especially =
the case when connecting to an Ethernet with a lot of UDP broadcast and =
the stack will soon run out of buffers.

It seems that when an UDP broadcast packet is sent to an non listening =
port the packet is just discarded but never free'd. I wonder why any of =
you hasn't noticed that the stack would run out of buffers ?!?

Robert do you again have the time for making these changes to the CVS.

BTW. I have now been running the stack (one of the first CVS versions with =
(almost) all the bugfixes) for several weeks now and it seems VERY STABLE. =
I'm running the stack with the SINGLE_TASK option, this means no semaphores=
 and multitasking, and with the use of callback functions.=20
I think that if the stack keeps up the good work, will will probably ship =
it with our product in the near future (6 months).

Best wishes to you all,

Mads Christiansen
Partner Voxtream
www.voxtream.com=20


Here is a fraction (the last part of udpInput) of my impl. (sorry about =
the tabs).




    /* Try to find an open udp port to receive the incoming packet */

    udpCB =3D udpResolveIncomingUDPCB(ntohl(ipHdr->ip_src.s_addr), =
ntohs(udpHdr->dstPort));
    if (udpCB =3D=3D NULL) {

				// Only reflect the packet if it is a =
unicast!!!
				if (ntohl(ipHdr->ip_dst.s_addr) =3D=3D =
localHost)
				{
					/* if port not open, or port is =
not listening for connections from that address reflect the packet */
					UDPDEBUG(("udpInput: port %ld not =
open, sending icmp_error\n", udpHdr->dstPort));
					icmp_error(inBuf, ICMP_UNREACH, =
ICMP_UNREACH_PORT, 0);
				}
                                 	// Free "memory" BUGFIX 22.01.02/MO=
GI
	  		nFreeChain(inBuf);
        return;
    }

    /* Add NBuf chain to the incoming data queue for the port */

    if (udpCB->tail) {
        udpCB->tail->next =3D alloc_udp_q();
        if (udpCB->tail->next =3D=3D NULL) {
            goto UDP_ALLOC_FAILED;
        }
        udpCB->tail =3D udpCB->tail->next;
    } else {
        udpCB->head =3D udpCB->tail =3D alloc_udp_q();
        if (udpCB->tail =3D=3D NULL) {
            goto UDP_ALLOC_FAILED;
        }
    }

    udpCB->tail->next =3D NULL;
    udpCB->tail->srcAddr =3D ipHdr->ip_src;
    udpCB->tail->srcPort =3D udpHdr->srcPort;
    udpCB->tail->nBuf =3D inBuf;

    // **** Remove IP and UDP header stuff
		nTrim(NULL, &udpCB->tail->nBuf, sizeof(IPHdr) + sizeof(UDPH=
dr));



#if ONETASK_SUPPORT > 0
    if (udpCB->receiveEvent)=20
          // Data received so notify user,=20
          udpCB->receiveEvent((int)(udpCB - &udps[0]), udpCB->tail->nBuf->c=
hainLen);=20
#else
    /* finally, post a semaphore to wake up anyone waiting for data on =
this UDP port */
    OSSemPost(udpCB->sem);
#endif
=20
    return;

UDP_ALLOC_FAILED:
    UDPDEBUG(("udpInput: port %ld, out of udp queue buffers\n", udpHdr->dst=
Port));
  	// Free "memory" BUGFIX 22.01.02/MOGI
	  nFreeChain(inBuf);
    return;
}