[Bug] lwip-dhcpd raw server leaks copied pbuf when request is larger than reply buffer

[K-ANOY]

RT-Thread Version

v5.0.2-2673-gac6dc197a0

Hardware Type/Architectures

Not hardware-specific. This is a source-level cleanup issue in the lwIP DHCP server component: components/net/lwip-dhcpd/dhcp_server_raw.c

Develop Toolchain

Other

Describe the bug

In components/net/lwip-dhcpd/dhcp_server_raw.c, dhcp_server_recv() allocates a new pbuf q to copy and build a DHCP response. If q is successfully allocated but is still smaller than the received pbuf p, the error path frees only p and returns. The newly allocated q is not freed.

Affected code:

q = pbuf_alloc(PBUF_TRANSPORT, 1500, PBUF_RAM);
if (q == NULL)
{
    LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_LEVEL_WARNING,
                ("pbuf_alloc dhcp_msg failed!\n"));
    pbuf_free(p);
    return;
}
if (q->tot_len < p->tot_len)
{
    LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_LEVEL_WARNING,
                ("pbuf_alloc dhcp_msg too small %d:%d\n", q->tot_len, p->tot_len));
    pbuf_free(p);
    return;
}

The normal paths later jump to free_pbuf_and_return, which frees q:

free_pbuf_and_return:
    pbuf_free(q);

However, the q->tot_len < p->tot_len branch returns before reaching that cleanup label.

Other additional context

No response