.github/workflows/codeql.yml

@@ -25,7 +25,7 @@ jobs:
     #   - https://gh.io/supported-runners-and-hardware-resources
     #   - https://gh.io/using-larger-runners
     # Consider using larger runners for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-20.04' }}
     timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
     permissions:
       actions: read

CHANGELOG

@@ -6,11 +6,6 @@ HISTORY
 
   * [Enter new changes just after this line - do not remove this line]
 
-  ++ Bugfixes:
-
-  2025-06-03: Simon Goldschmidt
-  * ip4_frag/ip6_frag: fix potential NULL-pointer access on memory errors
-
 (STABLE-2.2.1):
 
   ++ New features:

doc/doxygen/lwip.Doxyfile

@@ -38,7 +38,7 @@ PROJECT_NAME           = "lwIP"
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = "2.2.2.dev"
+PROJECT_NUMBER         = "2.2.1"
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

src/Filelists.cmake

@@ -14,11 +14,11 @@ endif()
 
 set(LWIP_VERSION_MAJOR    "2")
 set(LWIP_VERSION_MINOR    "2")
-set(LWIP_VERSION_REVISION "2")
+set(LWIP_VERSION_REVISION "1")
 # LWIP_VERSION_RC is set to LWIP_RC_RELEASE for official releases
 # LWIP_VERSION_RC is set to LWIP_RC_DEVELOPMENT for Git versions
 # Numbers 1..31 are reserved for release candidates
-set(LWIP_VERSION_RC       "LWIP_RC_DEVELOPMENT")
+set(LWIP_VERSION_RC       "LWIP_RC_RELEASE")
 
 if ("${LWIP_VERSION_RC}" STREQUAL "LWIP_RC_RELEASE")
     set(LWIP_VERSION_STRING

src/apps/http/altcp_proxyconnect.c

@@ -576,10 +576,6 @@ const struct altcp_functions altcp_proxyconnect_functions = {
   altcp_default_get_tcp_addrinfo,
   altcp_default_get_ip,
   altcp_default_get_port
-#if LWIP_TCP_KEEPALIVE
-  , altcp_default_keepalive_disable
-  , altcp_default_keepalive_enable
-#endif
 #ifdef LWIP_DEBUG
   , altcp_default_dbg_get_tcp_state
 #endif

src/apps/http/httpd.c

@@ -120,6 +120,7 @@
 #define CRLF "\r\n"
 #if LWIP_HTTPD_SUPPORT_11_KEEPALIVE
 #define HTTP11_CONNECTIONKEEPALIVE  "Connection: keep-alive"
+#define HTTP11_CONNECTIONKEEPALIVE2 "Connection: Keep-Alive"
 #endif
 
 #if LWIP_HTTPD_DYNAMIC_FILE_READ
@@ -2099,7 +2100,8 @@ http_parse_request(struct pbuf *inp, struct http_state *hs, struct altcp_pcb *pc
 #if LWIP_HTTPD_SUPPORT_11_KEEPALIVE
           /* This is HTTP/1.0 compatible: for strict 1.1, a connection
              would always be persistent unless "close" was specified. */
-          if (!is_09 && lwip_strnistr(data, HTTP11_CONNECTIONKEEPALIVE, data_len)) {
+          if (!is_09 && (lwip_strnistr(data, HTTP11_CONNECTIONKEEPALIVE, data_len) ||
+                         lwip_strnistr(data, HTTP11_CONNECTIONKEEPALIVE2, data_len))) {
             hs->keepalive = 1;
           } else {
             hs->keepalive = 0;

src/apps/snmp/snmp_asn1.c

@@ -463,8 +463,14 @@ snmp_asn1_dec_s32t(struct snmp_pbuf_stream *pbuf_stream, u16_t len, s32_t *value
   if ((len > 0) && (len < 5)) {
     PBUF_OP_EXEC(snmp_pbuf_stream_read(pbuf_stream, &data));
 
-    /* sign extension */
+    if (data & 0x80) {
-    *value = (s8_t)data;
+      /* negative, start from -1 */
+      *value = -1;
+      *value = (*value << 8) | data;
+    } else {
+      /* positive, start from 0 */
+      *value = data;
+    }
     len--;
     /* shift in the remaining value */
     while (len > 0) {

src/apps/tftp/tftp.c

@@ -454,13 +454,11 @@ tftp_init_common(u8_t mode, const struct tftp_context *ctx)
     return ERR_MEM;
   }
 
-  if (mode & LWIP_TFTP_MODE_SERVER) {
   ret = udp_bind(pcb, IP_ANY_TYPE, TFTP_PORT);
   if (ret != ERR_OK) {
     udp_remove(pcb);
     return ret;
   }
-  }
 
   tftp_state.handle    = NULL;
   tftp_state.port      = 0;

src/core/ipv4/autoip.c

@@ -223,10 +223,9 @@ autoip_conflict_callback(struct netif *netif, acd_callback_enum_t state)
       autoip_restart(netif);
       break;
     case ACD_DECLINE:
-      /* "delete" conflicting address and increment tried addr so a new one
+      /* "delete" conflicting address so a new one will be selected in
-       * will be selected in autoip_start() */
+       * autoip_start() */
       ip4_addr_set_any(&autoip->llipaddr);
-      autoip->tried_llipaddr++;
       autoip_stop(netif);
       break;
       default:

src/core/ipv4/dhcp.c

@@ -773,6 +773,9 @@ dhcp_set_struct(struct netif *netif, struct dhcp *dhcp)
  * @ingroup dhcp4
  * Removes a struct dhcp from a netif.
  *
+ * ATTENTION: Only use this when not using dhcp_set_struct() to allocate the
+ *            struct dhcp since the memory is passed back to the heap.
+ *
  * @param netif the netif from which to remove the struct dhcp
  */
 void dhcp_cleanup(struct netif *netif)
@@ -808,7 +811,6 @@ dhcp_start(struct netif *netif)
 {
   struct dhcp *dhcp;
   err_t result;
-  u8_t saved_flags;
 
   LWIP_ASSERT_CORE_LOCKED();
   LWIP_ERROR("netif != NULL", (netif != NULL), return ERR_ARG;);
@@ -831,8 +833,6 @@ dhcp_start(struct netif *netif)
       return ERR_MEM;
     }
 
-    /* clear the flags, the rest is cleared below */
-    dhcp->flags = 0;
     /* store this dhcp client in the netif */
     netif_set_client_data(netif, LWIP_NETIF_CLIENT_DATA_INDEX_DHCP, dhcp);
     LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE, ("dhcp_start(): allocated dhcp\n"));
@@ -846,10 +846,9 @@ dhcp_start(struct netif *netif)
     /* dhcp is cleared below, no need to reset flag*/
   }
 
-  /* clear data structure but preserve DHCP_FLAG_EXTERNAL_MEM for dhcp_cleanup() */
+  /* clear data structure */
-  saved_flags = dhcp->flags;
   memset(dhcp, 0, sizeof(struct dhcp));
-  dhcp->flags = saved_flags & DHCP_FLAG_EXTERNAL_MEM;
+  /* dhcp_set_state(&dhcp, DHCP_STATE_OFF); */
 
 
 #if LWIP_DHCP_DOES_ACD_CHECK

src/core/ipv4/etharp.c

@@ -940,9 +940,9 @@ etharp_query(struct netif *netif, const ip4_addr_t *ipaddr, struct pbuf *q)
   netif_addr_idx_t i;
 
   /* non-unicast address? */
-  if (ip4_addr_isany(ipaddr) ||
+  if (ip4_addr_isbroadcast(ipaddr, netif) ||
-      ip4_addr_isbroadcast(ipaddr, netif) ||
+      ip4_addr_ismulticast(ipaddr) ||
-      ip4_addr_ismulticast(ipaddr)) {
+      ip4_addr_isany(ipaddr)) {
     LWIP_DEBUGF(ETHARP_DEBUG | LWIP_DBG_TRACE, ("etharp_query: will not add non-unicast IP address to ARP cache\n"));
     return ERR_ARG;
   }

src/core/ipv4/ip4_frag.c

@@ -175,7 +175,6 @@ ip_reass_free_complete_datagram(struct ip_reassdata *ipr, struct ip_reassdata *p
 
   MIB2_STATS_INC(mib2.ipreasmfails);
 #if LWIP_ICMP
-  if (ipr->p != NULL) {
   iprh = (struct ip_reass_helper *)ipr->p->payload;
   if (iprh->start == 0) {
     /* The first fragment was received, send ICMP time exceeded. */
@@ -190,7 +189,6 @@ ip_reass_free_complete_datagram(struct ip_reassdata *ipr, struct ip_reassdata *p
     pbufs_freed = (u16_t)(pbufs_freed + clen);
     pbuf_free(p);
   }
-  }
 #endif /* LWIP_ICMP */
 
   /* First, free all received pbufs.  The individual pbufs need to be released

src/core/ipv6/ip6_frag.c

@@ -154,7 +154,6 @@ ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr)
   struct ip6_reass_helper *iprh;
 
 #if LWIP_ICMP6
-  if (ipr->p != NULL) {
   iprh = (struct ip6_reass_helper *)ipr->p->payload;
   if (iprh->start == 0) {
     /* The first fragment was received, send ICMP time exceeded. */
@@ -185,7 +184,6 @@ ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr)
     pbufs_freed = (u16_t)(pbufs_freed + clen);
     pbuf_free(p);
   }
-  }
 #endif /* LWIP_ICMP6 */
 
   /* First, free all received pbufs.  The individual pbufs need to be released

src/core/tcp_in.c

@@ -1993,17 +1993,17 @@ tcp_parseopt(struct tcp_pcb *pcb)
             return;
           }
           /* TCP timestamp option with valid length */
-          tsval = (tcp_get_next_optbyte() << 24);
+          tsval = tcp_get_next_optbyte();
-          tsval |= (tcp_get_next_optbyte() << 16);
           tsval |= (tcp_get_next_optbyte() << 8);
-          tsval |= tcp_get_next_optbyte();
+          tsval |= (tcp_get_next_optbyte() << 16);
+          tsval |= (tcp_get_next_optbyte() << 24);
           if (flags & TCP_SYN) {
-            pcb->ts_recent = tsval;
+            pcb->ts_recent = lwip_ntohl(tsval);
             /* Enable sending timestamps in every segment now that we know
                the remote host supports it. */
             tcp_set_flags(pcb, TF_TIMESTAMP);
           } else if (TCP_SEQ_BETWEEN(pcb->ts_lastacksent, seqno, seqno + tcplen)) {
-            pcb->ts_recent = tsval;
+            pcb->ts_recent = lwip_ntohl(tsval);
           }
           /* Advance to next option (6 bytes already read) */
           tcp_optidx += LWIP_TCP_OPT_LEN_TS - 6;

src/include/lwip/init.h

@@ -54,11 +54,11 @@ extern "C" {
 /** x.X.x: Minor version of the stack */
 #define LWIP_VERSION_MINOR      2
 /** x.x.X: Revision of the stack */
-#define LWIP_VERSION_REVISION   2
+#define LWIP_VERSION_REVISION   1
 /** For release candidates, this is set to 1..254
   * For official releases, this is set to 255 (LWIP_RC_RELEASE)
   * For development versions (Git), this is set to 0 (LWIP_RC_DEVELOPMENT) */
-#define LWIP_VERSION_RC         LWIP_RC_DEVELOPMENT
+#define LWIP_VERSION_RC         LWIP_RC_RELEASE
 
 /** LWIP_VERSION_RC is set to LWIP_RC_RELEASE for official releases */
 #define LWIP_RC_RELEASE         255

test/unit/ip6/test_ip6.c

@@ -519,7 +519,6 @@ START_TEST(test_ip6_reass)
   test_ip6_reass_helper(130, t3, NUM_SEGS, 8);
   test_ip6_reass_helper(130, t4, NUM_SEGS, 1448);
 }
-END_TEST
 
 /** Create the suite including all tests for this module */
 Suite *

test/unit/tcp/test_tcp.c

@@ -534,13 +534,15 @@ START_TEST(test_tcp_fast_retx_recover)
   EXPECT_RET(txcounters.num_tx_calls == 0);
   EXPECT_RET(txcounters.num_tx_bytes == 0);
   memset(&txcounters, 0, sizeof(txcounters));
-
+  {
+    int i = 0;
     do
     {
       err = tcp_write(pcb, data6, TCP_MSS, TCP_WRITE_FLAG_COPY);
+      i++;
     }while(err == ERR_OK);
     EXPECT_RET(err != ERR_OK);
-
+  }
   err = tcp_output(pcb);
   EXPECT_RET(err == ERR_OK);
   /*EXPECT_RET(txcounters.num_tx_calls == 0);