mirror of
https://git.savannah.nongnu.org/git/lwip.git
synced 2026-06-01 23:53:26 +08:00
Fixed bug #20429: use the new pbuf_copy_partial instead of the old copy_from_pbuf, which illegally modified the given pbuf; Introduced pbuf_copy_partial, making netbuf_copy_partial use this function.
This commit is contained in:
@@ -59,40 +59,6 @@ static u8_t ip_reassflags;
|
||||
static u8_t ip_reasstmr;
|
||||
#endif /* IP_REASSEMBLY */
|
||||
|
||||
#if IP_REASSEMBLY || (IP_FRAG && IP_FRAG_USES_STATIC_BUF)
|
||||
/*
|
||||
* Copy len bytes from offset in pbuf to buffer
|
||||
*
|
||||
* helper used by both ip_reass and ip_frag
|
||||
*
|
||||
* @param p pbuf chain to copy from
|
||||
* @param offset offset in bytes into the pbuf chain which should be skipped
|
||||
* before starting to copy
|
||||
* @param buffer destination to copy the data
|
||||
* @param len number of bytes to copy (starting from offset)
|
||||
* @return pointer to one pbuf in the chain p from which copied last
|
||||
*/
|
||||
static struct pbuf *
|
||||
copy_from_pbuf(struct pbuf *p, u16_t *offset, u8_t *buffer, u16_t len)
|
||||
{
|
||||
u16_t l;
|
||||
|
||||
p->payload = (u8_t *)p->payload + *offset;
|
||||
p->len -= *offset;
|
||||
while (len) {
|
||||
l = len < p->len ? len : p->len;
|
||||
MEMCPY(buffer, p->payload, l);
|
||||
buffer += l;
|
||||
len -= l;
|
||||
if (len)
|
||||
p = p->next;
|
||||
else
|
||||
*offset = l;
|
||||
}
|
||||
return p;
|
||||
}
|
||||
#endif /* IP_REASSEMBLY || IP_FRAG_USES_STATIC_BUF */
|
||||
|
||||
#if IP_REASSEMBLY
|
||||
/**
|
||||
* Initializes IP reassembly states.
|
||||
@@ -187,7 +153,7 @@ ip_reass(struct pbuf *p)
|
||||
("ip_reass: copying with offset %"S16_F" into %"S16_F":%"S16_F"\n", offset,
|
||||
IP_HLEN + offset, IP_HLEN + offset + len));
|
||||
i = IPH_HL(fraghdr) * 4;
|
||||
copy_from_pbuf(p, &i, &ip_reassbuf[IP_HLEN + offset], len);
|
||||
pbuf_copy_partial(p, &ip_reassbuf[IP_HLEN + offset], len, i);
|
||||
|
||||
/* Update the bitmap. */
|
||||
if (offset / (8 * 8) == (offset + len) / (8 * 8)) {
|
||||
@@ -392,7 +358,7 @@ ip_frag(struct pbuf *p, struct netif *netif, struct ip_addr *dest)
|
||||
cop = last ? left : nfb * 8;
|
||||
|
||||
#if IP_FRAG_USES_STATIC_BUF
|
||||
p = copy_from_pbuf(p, &poff, (u8_t *) iphdr + IP_HLEN, cop);
|
||||
poff += pbuf_copy_partial(p, (u8_t*)iphdr + IP_HLEN, cop, poff);
|
||||
#else /* IP_FRAG_USES_STATIC_BUF */
|
||||
/* When not using a static buffer, create a chain of pbufs.
|
||||
* The first will be a PBUF_RAM holding the link and IP header.
|
||||
|
||||
@@ -735,3 +735,50 @@ pbuf_copy(struct pbuf *p_to, struct pbuf *p_from)
|
||||
LWIP_DEBUGF(PBUF_DEBUG | LWIP_DBG_TRACE | 1, ("pbuf_copy: end of chain reached.\n"));
|
||||
return ERR_OK;
|
||||
}
|
||||
|
||||
/**
|
||||
* Copy (part of) the contents of a packet buffer
|
||||
* to an application supplied buffer.
|
||||
*
|
||||
* @param buf the pbuf from which to copy data
|
||||
* @param dataptr the application supplied buffer
|
||||
* @param len length of data to copy (dataptr must be big enough)
|
||||
* @param offset offset into the packet buffer from where to begin copying len bytes
|
||||
*/
|
||||
u16_t
|
||||
pbuf_copy_partial(struct pbuf *buf, void *dataptr, u16_t len, u16_t offset)
|
||||
{
|
||||
struct pbuf *p;
|
||||
u16_t left;
|
||||
u16_t buf_copy_len;
|
||||
u16_t copied_total = 0;
|
||||
|
||||
LWIP_ERROR("netbuf_copy_partial: invalid buf", (buf != NULL), return 0;);
|
||||
LWIP_ERROR("netbuf_copy_partial: invalid dataptr", (dataptr != NULL), return 0;);
|
||||
|
||||
left = 0;
|
||||
|
||||
if((buf == NULL) || (dataptr == NULL)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Note some systems use byte copy if dataptr or one of the pbuf payload pointers are unaligned. */
|
||||
for(p = buf; len != 0 && p != NULL; p = p->next) {
|
||||
if ((offset != 0) && (offset >= p->len)) {
|
||||
/* don't copy from this buffer -> on to the next */
|
||||
offset -= p->len;
|
||||
} else {
|
||||
/* copy from this buffer. maybe only partially. */
|
||||
buf_copy_len = p->len - offset;
|
||||
if (buf_copy_len > len)
|
||||
buf_copy_len = len;
|
||||
/* copy the necessary parts of the buffer */
|
||||
MEMCPY(&((char*)dataptr)[left], &((char*)p->payload)[offset], buf_copy_len);
|
||||
copied_total += buf_copy_len;
|
||||
left += buf_copy_len;
|
||||
len -= buf_copy_len;
|
||||
offset = 0;
|
||||
}
|
||||
}
|
||||
return copied_total;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user