Index: src/core/memp.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/memp.c,v
retrieving revision 1.46
diff -u -r1.46 memp.c
--- src/core/memp.c	15 Jul 2007 10:54:24 -0000	1.46
+++ src/core/memp.c	23 Jul 2007 20:47:57 -0000
@@ -47,6 +47,9 @@
 #if ARP_QUEUEING
 #include "netif/etharp.h"
 #endif
+#if IP_REASSEMBLY
+#include "lwip/ip_frag.h"
+#endif
 
 struct memp {
   struct memp *next;
@@ -123,6 +126,9 @@
   MEMP_ALIGN_SIZE(MEM_POOL_SIZE_3),
   MEMP_ALIGN_SIZE(MEM_POOL_SIZE_4),
 #endif
+#if IP_REASSEMBLY
+  MEMP_ALIGN_SIZE(sizeof(struct ip_reassdata)),
+#endif
 };
 
 static const u16_t memp_num[MEMP_MAX] = {
@@ -146,6 +152,9 @@
   MEM_POOL_NUM_3,
   MEM_POOL_NUM_4,
 #endif
+#if IP_REASSEMBLY
+  MEMP_NUM_REASSPACKETS,
+#endif
 };
 
 #define MEMP_TYPE_SIZE(qty, type) \
@@ -173,6 +182,9 @@
   + ((MEM_POOL_NUM_3) * MEMP_ALIGN_SIZE(MEM_POOL_SIZE_3))
   + ((MEM_POOL_NUM_4) * MEMP_ALIGN_SIZE(MEM_POOL_SIZE_4))
 #endif
+#if ARP_QUEUEING
+  + MEMP_TYPE_SIZE(MEMP_NUM_REASSPACKETS, struct ip_reassdata)
+#endif
 ];
 
 #if MEMP_SANITY_CHECK
Index: src/core/ipv4/ip_frag.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/ipv4/ip_frag.c,v
retrieving revision 1.32
diff -u -r1.32 ip_frag.c
--- src/core/ipv4/ip_frag.c	3 Jul 2007 20:28:36 -0000	1.32
+++ src/core/ipv4/ip_frag.c	23 Jul 2007 20:37:45 -0000
@@ -47,16 +47,30 @@
 #include "lwip/stats.h"
 
 #if IP_REASSEMBLY
-static u8_t ip_reassbuf[IP_HLEN + IP_REASS_BUFSIZE];
-static u8_t ip_reassbitmap[IP_REASS_BUFSIZE / (8 * 8) + 1];
-static const u8_t bitmap_bits[8] = { 0xff, 0x7f, 0x3f, 0x1f,
-  0x0f, 0x07, 0x03, 0x01
-};
-static u16_t ip_reasslen;
-static u8_t ip_reassflags;
 #define IP_REASS_FLAG_LASTFRAG 0x01
 
-static u8_t ip_reasstmr;
+/** This is a helper struct which holds the starting
+ * offset and the ending offset of this fragment to
+ * easily chain the fragments.
+ * It must be packet because the memory of the ip header
+ * of fragments is misused for holding this data.
+ */
+#ifdef PACK_STRUCT_USE_INCLUDES
+#  include "arch/bpstruct.h"
+#endif
+PACK_STRUCT_BEGIN
+struct ip_reass_helper {
+  PACK_STRUCT_FIELD(struct pbuf *next_pbuf);
+  PACK_STRUCT_FIELD(u16_t start);
+  PACK_STRUCT_FIELD(u16_t end);
+} PACK_STRUCT_STRUCT;
+PACK_STRUCT_END
+#ifdef PACK_STRUCT_USE_INCLUDES
+#  include "arch/epstruct.h"
+#endif
+
+static struct ip_reassdata *reasspackets;
+static u16_t ip_reass_pbufcount;
 #endif /* IP_REASSEMBLY */
 
 #if IP_REASSEMBLY || (IP_FRAG && IP_FRAG_USES_STATIC_BUF)
@@ -100,10 +114,8 @@
 void
 ip_reass_init(void)
 {
-  ip_reasstmr = 0;
-  ip_reassflags = 0;
-  ip_reasslen = 0;
-  memset(ip_reassbitmap, 0, sizeof(ip_reassbitmap));
+  LWIP_ASSERT("sizeof(struct ip_reass_helper) <= IP_HLEN",
+    sizeof(struct ip_reass_helper) <= IP_HLEN);
 }
 
 /**
@@ -115,12 +127,39 @@
 void
 ip_reass_tmr(void)
 {
-  if (ip_reasstmr > 0) {
-    ip_reasstmr--;
-    LWIP_DEBUGF(IP_REASS_DEBUG, ("ip_reass_tmr: timer dec %"U16_F"\n",(u16_t)ip_reasstmr));
-    if (ip_reasstmr == 0) {
-      /* reassembly timed out */
-      snmp_inc_ipreasmfails();
+  struct ip_reassdata *r, *prev = NULL;
+  r = reasspackets;
+  while (r != NULL) {
+    if (r->timer > 0) {
+      r->timer--;
+      LWIP_DEBUGF(IP_REASS_DEBUG, ("ip_reass_tmr: timer dec %"U16_F"\n",(u16_t)r->timer));
+      if (r->timer == 0) {
+        struct pbuf *p;
+        struct ip_reassdata *del;
+        /* reassembly timed out */
+        snmp_inc_ipreasmfails();
+        /* unchaing r from the list */
+        if(prev == NULL) {
+          reasspackets = r->next;
+        } else {
+          prev->next = r->next;
+        }
+        /* free all received pbufs */
+        for(p = r->p; p != NULL; p = p->next) {
+          pbuf_free(p);
+        }
+        /* free the reassdata struct */
+        del = r;
+        r = r->next;
+        memp_free(MEMP_REASSDATA, del);
+      } else {
+        prev = r;
+        r = r->next;
+      }
+      
+    } else {
+      prev = r;
+      r = r->next;
     }
   }
 }
@@ -134,173 +173,188 @@
 struct pbuf *
 ip_reass(struct pbuf *p)
 {
-  struct pbuf *q;
-  struct ip_hdr *fraghdr, *iphdr;
+  struct pbuf *q, *r;
+  struct ip_hdr *fraghdr;
+  struct ip_reassdata *ipr, *ipr_prev = NULL;
+  struct ip_reass_helper *iprh, *iprh2, *iprh_prev;
   u16_t offset, len;
-  u16_t i;
+  u8_t clen;
 
   IPFRAG_STATS_INC(ip_frag.recv);
   snmp_inc_ipreasmreqds();
 
-  iphdr = (struct ip_hdr *) ip_reassbuf;
-  fraghdr = (struct ip_hdr *) p->payload;
-  /* If ip_reasstmr is zero, no packet is present in the buffer, so we
-     write the IP header of the fragment into the reassembly
-     buffer. The timer is updated with the maximum age. */
-  if (ip_reasstmr == 0) {
-    LWIP_DEBUGF(IP_REASS_DEBUG, ("ip_reass: new packet\n"));
-    SMEMCPY(iphdr, fraghdr, IP_HLEN);
-    ip_reasstmr = IP_REASS_MAXAGE;
-    ip_reassflags = 0;
-    /* Clear the bitmap. */
-    memset(ip_reassbitmap, 0, sizeof(ip_reassbitmap));
-  }
-
-  /* Check if the incoming fragment matches the one currently present
-     in the reasembly buffer. If so, we proceed with copying the
-     fragment into the buffer. */
-  if (ip_addr_cmp(&iphdr->src, &fraghdr->src) &&
-      ip_addr_cmp(&iphdr->dest, &fraghdr->dest) &&
-      IPH_ID(iphdr) == IPH_ID(fraghdr)) {
-    LWIP_DEBUGF(IP_REASS_DEBUG, ("ip_reass: matching previous fragment ID=%"X16_F"\n",
-      ntohs(IPH_ID(fraghdr))));
-    IPFRAG_STATS_INC(ip_frag.cachehit);
-    /* Find out the offset in the reassembly buffer where we should
-       copy the fragment. */
-    len = ntohs(IPH_LEN(fraghdr)) - IPH_HL(fraghdr) * 4;
-    offset = (ntohs(IPH_OFFSET(fraghdr)) & IP_OFFMASK) * 8;
-
-    /* If the offset or the offset + fragment length overflows the
-       reassembly buffer, we discard the entire packet. */
-    if ((offset > IP_REASS_BUFSIZE) || ((offset + len) > IP_REASS_BUFSIZE)) {
-      LWIP_DEBUGF(IP_REASS_DEBUG,
-       ("ip_reass: fragment outside of buffer (%"S16_F":%"S16_F"/%"S16_F").\n", offset,
-        offset + len, IP_REASS_BUFSIZE));
-      ip_reasstmr = 0;
-      snmp_inc_ipreasmfails();
+  /* Check if we are allowed to enqueue more packets. */
+  clen = pbuf_clen(p);
+  if ((ip_reass_pbufcount + clen) > IP_REASS_MAX_PBUFS) {
+    IPFRAG_STATS_INC(ip_frag.memerr);
+    /* drop this pbuf */
+    goto nullreturn;
+  }
+
+  fraghdr = (struct ip_hdr*)p->payload;
+  for (ipr = reasspackets; ipr != NULL; ipr = ipr->next) {
+    /* Check if the incoming fragment matches the one currently present
+       in the reasembly buffer. If so, we proceed with copying the
+       fragment into the buffer. */
+    if (ip_addr_cmp(&ipr->iphdr.src, &fraghdr->src) &&
+        ip_addr_cmp(&ipr->iphdr.dest, &fraghdr->dest) &&
+        IPH_ID(&ipr->iphdr) == IPH_ID(fraghdr)) {
+      LWIP_DEBUGF(IP_REASS_DEBUG, ("ip_reass: matching previous fragment ID=%"X16_F"\n",
+        ntohs(IPH_ID(fraghdr))));
+      IPFRAG_STATS_INC(ip_frag.cachehit);
+      break;
+    }
+    ipr_prev = ipr;
+  }
+  if (ipr == NULL) {
+    /* No matching previous fragment found, allocate a new reassdata struct */
+    ipr = memp_malloc(MEMP_REASSDATA);
+    if (ipr == NULL) {
+      IPFRAG_STATS_INC(ip_frag.memerr);
       goto nullreturn;
     }
+    memset(ipr, 0, sizeof(struct ip_reassdata));
+    ipr->timer = IP_REASS_MAXAGE;
+    /* enqueue the new structure to the front of the list */
+    if (reasspackets != NULL) {
+      ipr->next = reasspackets;
+      reasspackets->prev = ipr;
+    }
+    reasspackets = ipr;
+    /* copy the ip header for later tests and input */
+    /* @todo: no ip options supported? */
+    SMEMCPY(&ipr->iphdr, p->payload, IP_HLEN);
+  }
+  ip_reass_pbufcount += clen;
+
+  /* At this point, we have either created a new entry or pointing 
+   * to an existing one */
 
-    /* Copy the fragment into the reassembly buffer, at the right
-       offset. */
+  /* Find out the offset in the reassembly buffer where we should
+     copy the fragment. */
+  len = ntohs(IPH_LEN(fraghdr)) - IPH_HL(fraghdr) * 4;
+  offset = (ntohs(IPH_OFFSET(fraghdr)) & IP_OFFMASK) * 8;
+
+  /* check for 'no more fragments' */
+  if ((ntohs(IPH_OFFSET(fraghdr)) & IP_MF) == 0) {
+    ipr->flags |= IP_REASS_FLAG_LASTFRAG;
+    ipr->packet_len = offset + len;
     LWIP_DEBUGF(IP_REASS_DEBUG,
-     ("ip_reass: copying with offset %"S16_F" into %"S16_F":%"S16_F"\n", offset,
-      IP_HLEN + offset, IP_HLEN + offset + len));
-    i = IPH_HL(fraghdr) * 4;
-    copy_from_pbuf(p, &i, &ip_reassbuf[IP_HLEN + offset], len);
-
-    /* Update the bitmap. */
-    if (offset / (8 * 8) == (offset + len) / (8 * 8)) {
-      LWIP_DEBUGF(IP_REASS_DEBUG,
-       ("ip_reass: updating single byte in bitmap.\n"));
-      /* If the two endpoints are in the same byte, we only update that byte. */
-      LWIP_ASSERT("offset / (8 * 8) < sizeof(ip_reassbitmap)",
-                   offset / (8 * 8) < sizeof(ip_reassbitmap));
-      ip_reassbitmap[offset / (8 * 8)] |=
-        bitmap_bits[(offset / 8) & 7] &
-        ~bitmap_bits[((offset + len) / 8) & 7];
-    } else {
-      /* If the two endpoints are in different bytes, we update the
-         bytes in the endpoints and fill the stuff inbetween with
-         0xff. */
-      LWIP_ASSERT("offset / (8 * 8) < sizeof(ip_reassbitmap)",
-                   offset / (8 * 8) < sizeof(ip_reassbitmap));
-      ip_reassbitmap[offset / (8 * 8)] |= bitmap_bits[(offset / 8) & 7];
-      LWIP_DEBUGF(IP_REASS_DEBUG,
-       ("ip_reass: updating many bytes in bitmap (%"S16_F":%"S16_F").\n",
-        1 + offset / (8 * 8), (offset + len) / (8 * 8)));
-      for (i = 1 + offset / (8 * 8); i < (offset + len) / (8 * 8); ++i) {
-        ip_reassbitmap[i] = 0xff;
+     ("ip_reass: last fragment seen, total len %"S16_F"\n",
+      ipr->packet_len));
+  }
+
+  /* overwrite the ip header from the pbuf with our helper struct */
+  iprh = (struct ip_reass_helper*)p->payload;
+  iprh->next_pbuf = NULL;
+  iprh->start = offset;
+  iprh->end = offset + len;
+
+  /* find the right place to insert this pbuf */
+  /* @todo: trim pbufs if fragments are overlapping */
+  iprh_prev = NULL;
+  for (q = ipr->p; q != NULL; ) {
+    iprh2 = (struct ip_reass_helper*)q->payload;
+    if (iprh->start < iprh2->start) {
+      /* the new pbuf should be inserted before this */
+      iprh->next_pbuf = q;
+      if (iprh_prev != NULL) {
+        /* not the fragment with the lowest offset */
+        iprh_prev->next_pbuf = p;
+      } else {
+        /* fragment with the lowest offset */
+        ipr->p = p;
       }
-      LWIP_ASSERT("(offset + len) / (8 * 8) < sizeof(ip_reassbitmap)",
-                   (offset + len) / (8 * 8) < sizeof(ip_reassbitmap));
-      ip_reassbitmap[(offset + len) / (8 * 8)] |=
-        ~bitmap_bits[((offset + len) / 8) & 7];
+      break;
     }
-
-    /* If this fragment has the More Fragments flag set to zero, we
-       know that this is the last fragment, so we can calculate the
-       size of the entire packet. We also set the
-       IP_REASS_FLAG_LASTFRAG flag to indicate that we have received
-       the final fragment. */
-
-    if ((ntohs(IPH_OFFSET(fraghdr)) & IP_MF) == 0) {
-      ip_reassflags |= IP_REASS_FLAG_LASTFRAG;
-      ip_reasslen = offset + len;
-      LWIP_DEBUGF(IP_REASS_DEBUG,
-       ("ip_reass: last fragment seen, total len %"S16_F"\n",
-        ip_reasslen));
+    q = iprh2->next_pbuf;
+    iprh_prev = iprh2;
+  }
+  if (q == NULL) {
+    /* did not find any fragment with lower offset! */
+    if (iprh_prev != NULL) {
+      /* this is (for now), the fragment with the highest offset:
+       * chain it to the last fragment */
+      iprh_prev->next_pbuf = p;
+    } else {
+      /* this is the first fragment we ever received for this ip packet */
+      ipr->p = p;
     }
+  }
 
-    /* Finally, we check if we have a full packet in the buffer. We do
-       this by checking if we have the last fragment and if all bits
-       in the bitmap are set. */
-    if (ip_reassflags & IP_REASS_FLAG_LASTFRAG) {
-      /* Check all bytes up to and including all but the last byte in
-         the bitmap. */
-      LWIP_ASSERT("ip_reasslen / (8 * 8) - 1 < sizeof(ip_reassbitmap)",
-                   ip_reasslen / (8 * 8) - 1 < sizeof(ip_reassbitmap));
-      for (i = 0; i < ip_reasslen / (8 * 8) - 1; ++i) {
-        if (ip_reassbitmap[i] != 0xff) {
-          LWIP_DEBUGF(IP_REASS_DEBUG,
-           ("ip_reass: last fragment seen, bitmap %"S16_F"/%"S16_F" failed (%"X16_F")\n",
-            i, ip_reasslen / (8 * 8) - 1, ip_reassbitmap[i]));
-          goto nullreturn;
+  if ((ipr->flags & IP_REASS_FLAG_LASTFRAG) != 0) {
+    /* the totally last fragment (flag more fragments = 0) was received at least
+     * once: check if all fragments are received */
+    iprh = (struct ip_reass_helper*)ipr->p->payload;
+    if (iprh->start == 0) {
+      /* the first packet was received, check for the rest */
+      iprh_prev = iprh;
+      q = iprh->next_pbuf;
+      while (q != NULL) {
+        iprh = (struct ip_reass_helper*)q->payload;
+        if (iprh->start != (iprh_prev->end)) {
+          iprh_prev = iprh;
+          break;
         }
+        iprh_prev = iprh;
+        q = iprh->next_pbuf;
       }
-      /* Check the last byte in the bitmap. It should contain just the
-         right amount of bits. */
-      LWIP_ASSERT("ip_reasslen / (8 * 8) < sizeof(ip_reassbitmap)",
-                   ip_reasslen / (8 * 8) < sizeof(ip_reassbitmap));
-      if (ip_reassbitmap[ip_reasslen / (8 * 8)] !=
-        (u8_t) ~ bitmap_bits[ip_reasslen / 8 & 7]) {
-         LWIP_DEBUGF(IP_REASS_DEBUG,
-          ("ip_reass: last fragment seen, bitmap %"S16_F" didn't contain %"X16_F" (%"X16_F")\n",
-        ip_reasslen / (8 * 8), ~bitmap_bits[ip_reasslen / 8 & 7],
-        ip_reassbitmap[ip_reasslen / (8 * 8)]));
-        goto nullreturn;
-      }
-
-      /* Pretend to be a "normal" (i.e., not fragmented) IP packet
-         from now on. */
-      ip_reasslen += IP_HLEN;
-
-      IPH_LEN_SET(iphdr, htons(ip_reasslen));
-      IPH_OFFSET_SET(iphdr, 0);
-      IPH_CHKSUM_SET(iphdr, 0);
-      IPH_CHKSUM_SET(iphdr, inet_chksum(iphdr, IP_HLEN));
-
-      /* If we have come this far, we have a full packet in the
-         buffer, so we allocate a pbuf and copy the packet into it. We
-         also reset the timer. */
-      ip_reasstmr = 0;
-      pbuf_free(p);
-      p = pbuf_alloc(PBUF_LINK, ip_reasslen, PBUF_POOL);
-      if (p != NULL) {
-        i = 0;
-        for (q = p; q != NULL; q = q->next) {
-          /* Copy enough bytes to fill this pbuf in the chain. The
-             available data in the pbuf is given by the q->len variable. */
-          LWIP_DEBUGF(IP_REASS_DEBUG,
-           ("ip_reass: memcpy from %p (%"S16_F") to %p, %"S16_F" bytes\n",
-            (void *)&ip_reassbuf[i], i, q->payload,
-            q->len > ip_reasslen - i ? ip_reasslen - i : q->len));
-          MEMCPY(q->payload, &ip_reassbuf[i],
-            q->len > ip_reasslen - i ? ip_reasslen - i : q->len);
-          i += q->len;
+      if (q == NULL) {
+        /* did not break in between, processed all fragments! */
+        LWIP_ASSERT("sanit check", iprh_prev != NULL);
+        LWIP_ASSERT("blub", iprh_prev->next_pbuf == NULL);
+        LWIP_ASSERT("blub", iprh_prev->end == ipr->packet_len);
+
+        /* complete packet received! */
+        ipr->packet_len += IP_HLEN;
+
+        /* save the second pbuf before copying the header over the pointer */
+        r = ((struct ip_reass_helper*)ipr->p->payload)->next_pbuf;
+        /* copy the original ip header back to the first pbuf */
+        fraghdr = (struct ip_hdr*)ipr->p->payload;
+        SMEMCPY(fraghdr, &ipr->iphdr, IP_HLEN);
+        IPH_LEN_SET(fraghdr, htons(ipr->packet_len));
+        IPH_OFFSET_SET(fraghdr, 0);
+        IPH_CHKSUM_SET(fraghdr, 0);
+        /* @todo: do we need to set calculate the correct checksum? */
+        IPH_CHKSUM_SET(fraghdr, inet_chksum(fraghdr, IP_HLEN));
+
+        /* chain the pbufs correctly */
+        /* r is alreay set to the second pbuf above,
+         * this is also the return value */
+        p = ipr->p;
+        while(r != NULL) {
+          iprh = (struct ip_reass_helper*)r->payload;
+          /* hide the ip header for every succeding fragment */
+          pbuf_header(r, -IP_HLEN);
+          pbuf_cat(p, r);
+          r = iprh->next_pbuf;
         }
-        IPFRAG_STATS_INC(ip_frag.fw);
-        snmp_inc_ipreasmoks();
-      } else {
-        LWIP_DEBUGF(IP_REASS_DEBUG,
-          ("ip_reass: pbuf_alloc(PBUF_LINK, ip_reasslen=%"U16_F", PBUF_POOL) failed\n", ip_reasslen));
-        IPFRAG_STATS_INC(ip_frag.memerr);
-        snmp_inc_ipreasmfails();
+        
+        /* dequeue the reass struct  */
+        if (reasspackets == ipr) {
+          /* it was the first in the list */
+          reasspackets = ipr->next;
+        } else {
+          /* it wasn't the first, so it must have a valid 'prev' */
+          LWIP_ASSERT("sanity check linked list", ipr->prev != NULL);
+          ipr->prev->next = ipr->next;
+        }
+        if (ipr->next != NULL) {
+          ipr->next->prev = ipr->prev;
+        }
+        /* now we can free the ip_reass struct */
+        memp_free(MEMP_REASSDATA, ipr);
+        /* and adjust the number of pbufs currently queued for reassembly */
+        ip_reass_pbufcount -= pbuf_clen(p);
+
+        /* return the completely reassembled packet */
+        return p;
       }
-      LWIP_DEBUGF(IP_REASS_DEBUG, ("ip_reass: p %p\n", (void*)p));
-      return p;
     }
   }
+  /* the packet is not yet reassembled completely */
+  return NULL;
 
 nullreturn:
   IPFRAG_STATS_INC(ip_frag.drop);
Index: src/include/ipv4/lwip/ip_frag.h
===================================================================
RCS file: /sources/lwip/lwip/src/include/ipv4/lwip/ip_frag.h,v
retrieving revision 1.12
diff -u -r1.12 ip_frag.h
--- src/include/ipv4/lwip/ip_frag.h	3 Jun 2007 18:36:43 -0000	1.12
+++ src/include/ipv4/lwip/ip_frag.h	23 Jul 2007 20:47:05 -0000
@@ -47,6 +47,16 @@
 /* The IP reassembly timer interval in milliseconds. */
 #define IP_TMR_INTERVAL 1000
 
+struct ip_reassdata {
+  struct ip_reassdata *next;
+  struct pbuf *p;
+  struct ip_hdr iphdr;
+  u16_t packet_len;
+  u8_t flags;
+  u8_t timer;
+  struct ip_reassdata *prev;
+};
+
 void ip_reass_init(void);
 void ip_reass_tmr(void);
 struct pbuf * ip_reass(struct pbuf *p);
Index: src/include/lwip/memp.h
===================================================================
RCS file: /sources/lwip/lwip/src/include/lwip/memp.h,v
retrieving revision 1.18
diff -u -r1.18 memp.h
--- src/include/lwip/memp.h	21 Jun 2007 20:12:11 -0000	1.18
+++ src/include/lwip/memp.h	23 Jul 2007 18:03:48 -0000
@@ -62,7 +62,9 @@
   MEMP_MEM_POOL_3,
   MEMP_MEM_POOL_4,
 #endif
-
+#if IP_REASSEMBLY
+  MEMP_REASSDATA,
+#endif
   MEMP_MAX
 } memp_t;
 
Index: src/include/lwip/opt.h
===================================================================
RCS file: /sources/lwip/lwip/src/include/lwip/opt.h,v
retrieving revision 1.73
diff -u -r1.73 opt.h
--- src/include/lwip/opt.h	13 Jul 2007 15:00:41 -0000	1.73
+++ src/include/lwip/opt.h	23 Jul 2007 20:51:07 -0000
@@ -205,6 +205,11 @@
 #define MEMP_NUM_TCPIP_MSG              8
 #endif
 
+/* MEMP_NUM_REASSPACKETS: the number of simultaneously reassembled
+   IP packets. */
+#ifndef MEMP_NUM_REASSPACKETS
+#define MEMP_NUM_REASSPACKETS           3
+#endif
 
 /* ---------- ARP options ---------- */
 #ifndef LWIP_ARP
@@ -299,6 +304,15 @@
 #define IP_REASS_BUFSIZE                5760
 #endif
 
+/* The maximum number of pbufs simultaneously being queued for
+   reassembly.
+   ATTENTION: Make sure this is LESS than PBUF_POOL_SIZE to prevent
+   IP reassembly from consuming all PBUF_POOL buffers, which would lead
+   to a dead-lock since no packets can be received any more. */
+#ifndef IP_REASS_MAX_PBUFS
+#define IP_REASS_MAX_PBUFS              10
+#endif
+
 /* Use a static MTU-sized buffer for IP fragmentation.
 
     * Otherwise pbufs are allocated and reference the original
