[Click] IPFragmenter bug (click-1.4.3)

[Alfeiks Kaanoken]

So, continuing the bug finding.
I decide to do the following things to be sure for the normal backtrace -
- I removed inline directives from element.hh (include/click/element.hh)
- I moved all code from element.hh to the element.cc (lib/element.cc)
and get the new ideas and things.
I get the new bt -
click: ../lib/ipflowid.cc:32: IPFlowID::IPFlowID(const Packet*): 
Assertion `iph && udph && (((iph)->ip_off & (__extension__ ({ register 
unsigned short int __v, __x = (0x1fff); if (__builtin_constant_p (__x)) 
__v = ((((__x) >> 8) & 0xff) | (((__x) & 0xff) << 8)); else __asm__ 
("rorw $8, %w0" : "=r" (__v) : "0" (__x) : "cc"); __v; }))) == 0)' failed.

Program received signal SIGABRT, Aborted.
0x4013bd81 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4013bd81 in kill () from /lib/libc.so.6
#1  0x4013bb05 in raise () from /lib/libc.so.6
#2  0x4013d05d in abort () from /lib/libc.so.6
#3  0x4013500f in __assert_fail () from /lib/libc.so.6
#4  0x080f0007 in IPFlowID (this=0xbffff2e0, p=0x0) at ../lib/ipflowid.cc:32
#5  0x080c69f3 in IPRewriter::push (this=0x8162150, port=0, p_in=0x0)
    at ../elements/tcpudp/iprewriter.cc:292
#6  0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8166320) at 
../lib/element.cc:986
#7  0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8166320) at 
../lib/element.cc:986
#8  0x080940e7 in IPFragmenter::fragment (this=0x8164350, p_in=0x8166240)
    at ../elements/ip/ipfragmenter.cc:162
#9  0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8166240) at 
../lib/element.cc:986
#10 0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8166240) at 
../lib/element.cc:986
#11 0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8166240) at 
../lib/element.cc:986
#12 0x080b82ae in PaintTee::simple_action (this=0x40227ff4, p=0x8168288)
    at ../elements/standard/painttee.cc:50
#13 0x080f6b25 in Element::push (this=0x8164470, p=0x8168288) at 
../lib/element.cc:848
#14 0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8168288) at 
../lib/element.cc:986
#15 0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8168288) at 
../lib/element.cc:986
#16 0x0809fdd9 in LinearIPLookup::push (this=0x815efe0, p=0x8168288)
    at ../elements/ip/lineariplookup.cc:304
#17 0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8168288) at 
../lib/element.cc:986
#18 0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8168288) at 
../lib/element.cc:986
#19 0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8168288) at 
../lib/element.cc:986
#20 0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8168288) at 
../lib/element.cc:986
#21 0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8168288) at 
../lib/element.cc:986
#22 0x080d2007 in FromDevice::selected (this=0x815f6f8)
    at ../elements/userlevel/fromdevice.cc:364
#23 0x0810d873 in Master::run_selects (this=0x815eba8, more_tasks=244) 
at ../lib/master.cc:597
#24 0x08101c40 in RouterThread::driver (this=0x815ec98) at 
routerthread.hh:161
#25 0x080e7b63 in main (argc=3, argv=0xbffff804) at master.hh:121

and I decide to look at the pointers
(gdb) f 5
#5  0x080c69f3 in IPRewriter::push (this=0x8162150, port=0, p_in=0x0)
    at ../elements/tcpudp/iprewriter.cc:292
292       IPFlowID flow(p);
(gdb) p p_in
$1 = (Packet *) 0x0
(gdb) f 6
#6  0x080f6ee0 in Element::Port::push (this=0x40227ff4, p=0x8166320) at 
../lib/element.cc:986
986         _e->push(_port, p);
(gdb) p p
$2 = (Packet *) 0x8166320
(gdb) p _e
$4 = (Element *) 0x114d3c
How you can see the ``_e'' pointer address is not valid.
Now I will look for the ``Element::Port::Port(Element* owner, Element* 
e, int p)'' calling, because I think that this creation process is going 
without correct parameters.
Is any other ideas ?

Thanks

-- 
Alfeiks Kaänoken,
UNIX Software Developer.