Index: src/core/dhcp.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/dhcp.c,v
retrieving revision 1.120
diff -u -r1.120 dhcp.c
--- src/core/dhcp.c	9 Feb 2010 11:40:46 -0000	1.120
+++ src/core/dhcp.c	9 Feb 2010 21:35:04 -0000
@@ -314,7 +314,7 @@
 
     dhcp_option_trailer(dhcp);
     /* shrink the pbuf to the actual content length */
-    pbuf_realloc(dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
+    pbuf_realloc(&dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
 
     /* send broadcast to any DHCP server */
     udp_sendto_if(dhcp->pcb, dhcp->p_out, IP_ADDR_BROADCAST, DHCP_SERVER_PORT, netif);
@@ -706,7 +706,7 @@
 
     dhcp_option_trailer(&dhcp);
 
-    pbuf_realloc(dhcp.p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp.options_out_len);
+    pbuf_realloc(&dhcp.p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp.options_out_len);
 
     LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_STATE, ("dhcp_inform: INFORMING\n"));
     udp_sendto_if(pcb, dhcp.p_out, IP_ADDR_BROADCAST, DHCP_SERVER_PORT, netif);
@@ -805,7 +805,7 @@
 
     dhcp_option_trailer(dhcp);
     /* resize pbuf to reflect true size of options */
-    pbuf_realloc(dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
+    pbuf_realloc(&dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
 
     /* per section 4.4.4, broadcast DECLINE messages */
     udp_sendto_if(dhcp->pcb, dhcp->p_out, IP_ADDR_BROADCAST, DHCP_SERVER_PORT, netif);
@@ -857,7 +857,7 @@
     dhcp_option_trailer(dhcp);
 
     LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE, ("dhcp_discover: realloc()ing\n"));
-    pbuf_realloc(dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
+    pbuf_realloc(&dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
 
     LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE, ("dhcp_discover: sendto(DISCOVER, IP_ADDR_BROADCAST, DHCP_SERVER_PORT)\n"));
     udp_sendto_if(dhcp->pcb, dhcp->p_out, IP_ADDR_BROADCAST, DHCP_SERVER_PORT, netif);
@@ -1022,7 +1022,7 @@
     /* append DHCP message trailer */
     dhcp_option_trailer(dhcp);
 
-    pbuf_realloc(dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
+    pbuf_realloc(&dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
 
     udp_sendto_if(dhcp->pcb, dhcp->p_out, &dhcp->server_ip_addr, DHCP_SERVER_PORT, netif);
     dhcp_delete_request(dhcp);
@@ -1088,7 +1088,7 @@
 
     dhcp_option_trailer(dhcp);
 
-    pbuf_realloc(dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
+    pbuf_realloc(&dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
 
     /* broadcast to server */
     udp_sendto_if(dhcp->pcb, dhcp->p_out, IP_ADDR_BROADCAST, DHCP_SERVER_PORT, netif);
@@ -1133,7 +1133,7 @@
 
     dhcp_option_trailer(dhcp);
 
-    pbuf_realloc(dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
+    pbuf_realloc(&dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
 
     /* broadcast to server */
     udp_sendto_if(dhcp->pcb, dhcp->p_out, IP_ADDR_BROADCAST, DHCP_SERVER_PORT, netif);
@@ -1183,7 +1183,7 @@
 
     dhcp_option_trailer(dhcp);
 
-    pbuf_realloc(dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
+    pbuf_realloc(&dhcp->p_out, sizeof(struct dhcp_msg) - DHCP_OPTIONS_LEN + dhcp->options_out_len);
 
     udp_sendto_if(dhcp->pcb, dhcp->p_out, &dhcp->server_ip_addr, DHCP_SERVER_PORT, netif);
     dhcp_delete_request(dhcp);
Index: src/core/dns.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/dns.c,v
retrieving revision 1.36
diff -u -r1.36 dns.c
--- src/core/dns.c	9 Feb 2010 11:38:59 -0000	1.36
+++ src/core/dns.c	9 Feb 2010 21:35:04 -0000
@@ -625,7 +625,7 @@
     MEMCPY( query, &qry, SIZEOF_DNS_QUERY);
 
     /* resize pbuf to the exact dns query */
-    pbuf_realloc(p, (u16_t)((query + SIZEOF_DNS_QUERY) - ((char*)(p->payload))));
+    pbuf_realloc(&p, (u16_t)((query + SIZEOF_DNS_QUERY) - ((char*)(p->payload))));
 
     /* connect to the server for faster receiving */
     udp_connect(dns_pcb, &dns_servers[numdns], DNS_SERVER_PORT);
Index: src/core/pbuf.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/pbuf.c,v
retrieving revision 1.138
diff -u -r1.138 pbuf.c
--- src/core/pbuf.c	2 Feb 2010 20:14:05 -0000	1.138
+++ src/core/pbuf.c	9 Feb 2010 21:35:04 -0000
@@ -340,31 +340,31 @@
  * @note Despite its name, pbuf_realloc cannot grow the size of a pbuf (chain).
  */
 void
-pbuf_realloc(struct pbuf *p, u16_t new_len)
+pbuf_realloc(struct pbuf **p, u16_t new_len)
 {
   struct pbuf *q;
   u16_t rem_len; /* remaining length */
   s32_t grow;
 
-  LWIP_ASSERT("pbuf_realloc: p != NULL", p != NULL);
-  LWIP_ASSERT("pbuf_realloc: sane p->type", p->type == PBUF_POOL ||
-              p->type == PBUF_ROM ||
-              p->type == PBUF_RAM ||
-              p->type == PBUF_REF);
+  LWIP_ASSERT("pbuf_realloc: *p != NULL", *p != NULL);
+  LWIP_ASSERT("pbuf_realloc: sane (*p)->type", (*p)->type == PBUF_POOL ||
+              (*p)->type == PBUF_ROM ||
+              (*p)->type == PBUF_RAM ||
+              (*p)->type == PBUF_REF);
 
   /* desired length larger than current length? */
-  if (new_len >= p->tot_len) {
+  if (new_len >= (*p)->tot_len) {
     /* enlarging not yet supported */
     return;
   }
 
-  /* the pbuf chain grows by (new_len - p->tot_len) bytes
+  /* the pbuf chain grows by (new_len - (*p)->tot_len) bytes
    * (which may be negative in case of shrinking) */
-  grow = new_len - p->tot_len;
+  grow = new_len - (*p)->tot_len;
 
   /* first, step over any pbufs that should remain in the chain */
   rem_len = new_len;
-  q = p;
+  q = *p;
   /* should this pbuf be kept? */
   while (rem_len > q->len) {
     /* decrease remaining length by pbuf length */
@@ -385,6 +385,7 @@
     /* reallocate and adjust the length of the pbuf that will be split */
     q = (struct pbuf *)mem_realloc(q, (u16_t)((u8_t *)q->payload - (u8_t *)q) + rem_len);
     LWIP_ASSERT("mem_realloc give q == NULL", q != NULL);
+    *p = q;
   }
   /* adjust length fields for new last pbuf */
   q->len = rem_len;
Index: src/core/tcp_in.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/tcp_in.c,v
retrieving revision 1.133
diff -u -r1.133 tcp_in.c
--- src/core/tcp_in.c	4 Feb 2010 18:47:44 -0000	1.133
+++ src/core/tcp_in.c	9 Feb 2010 21:35:04 -0000
@@ -785,7 +785,7 @@
         TCP_SEQ_GT(seqno + cseg->len, next->tcphdr->seqno)) {
       /* We need to trim the incoming segment. */
       cseg->len = (u16_t)(next->tcphdr->seqno - seqno);
-      pbuf_realloc(cseg->p, cseg->len);
+      pbuf_realloc(&cseg->p, cseg->len);
     }
   }
   cseg->next = next;
@@ -1172,7 +1172,7 @@
           if (TCPH_FLAGS(inseg.tcphdr) & TCP_SYN) {
             inseg.len -= 1;
           }
-          pbuf_realloc(inseg.p, inseg.len);
+          pbuf_realloc(&inseg.p, inseg.len);
           tcplen = TCP_TCPLEN(&inseg);
           LWIP_ASSERT("tcp_receive: segment not trimmed correctly to rcv_wnd\n",
                       (seqno + tcplen) == (pcb->rcv_nxt + pcb->rcv_wnd));
@@ -1222,7 +1222,7 @@
               if (TCPH_FLAGS(inseg.tcphdr) & TCP_SYN) {
                 inseg.len -= 1;
               }
-              pbuf_realloc(inseg.p, inseg.len);
+              pbuf_realloc(&inseg.p, inseg.len);
               tcplen = TCP_TCPLEN(&inseg);
               LWIP_ASSERT("tcp_receive: segment not trimmed correctly to ooseq queue\n",
                           (seqno + tcplen) == next->tcphdr->seqno);
@@ -1379,7 +1379,7 @@
                     if (TCP_SEQ_GT(prev->tcphdr->seqno + prev->len, seqno)) {
                       /* We need to trim the prev segment. */
                       prev->len = (u16_t)(seqno - prev->tcphdr->seqno);
-                      pbuf_realloc(prev->p, prev->len);
+                      pbuf_realloc(&prev->p, prev->len);
                     }
                     prev->next = cseg;
                     tcp_oos_insert_segment(cseg, next);
@@ -1401,7 +1401,7 @@
                   if (TCP_SEQ_GT(next->tcphdr->seqno + next->len, seqno)) {
                     /* We need to trim the last segment. */
                     next->len = (u16_t)(seqno - next->tcphdr->seqno);
-                    pbuf_realloc(next->p, next->len);
+                    pbuf_realloc(&next->p, next->len);
                   }
                 }
                 break;
Index: src/core/ipv4/ip.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/ipv4/ip.c,v
retrieving revision 1.83
diff -u -r1.83 ip.c
--- src/core/ipv4/ip.c	4 Feb 2010 18:47:44 -0000	1.83
+++ src/core/ipv4/ip.c	9 Feb 2010 21:35:04 -0000
@@ -257,7 +257,7 @@
 
   /* Trim pbuf. This should have been done at the netif layer,
    * but we'll do it anyway just to be sure that its done. */
-  pbuf_realloc(p, iphdr_len);
+  pbuf_realloc(&p, iphdr_len);
 
   /* match packet against an interface, i.e. is this packet for us? */
 #if LWIP_IGMP
Index: src/core/ipv4/ip_frag.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/ipv4/ip_frag.c,v
retrieving revision 1.52
diff -u -r1.52 ip_frag.c
--- src/core/ipv4/ip_frag.c	4 Feb 2010 18:47:44 -0000	1.52
+++ src/core/ipv4/ip_frag.c	9 Feb 2010 21:35:04 -0000
@@ -749,7 +749,7 @@
 
 #if IP_FRAG_USES_STATIC_BUF
     if (last)
-      pbuf_realloc(rambuf, left + IP_HLEN);
+      pbuf_realloc(&rambuf, left + IP_HLEN);
 
     /* This part is ugly: we alloc a RAM based pbuf for 
      * the link level header for each chunk and then 
Index: src/core/ipv6/ip6.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/ipv6/ip6.c,v
retrieving revision 1.20
diff -u -r1.20 ip6.c
--- src/core/ipv6/ip6.c	15 Apr 2009 19:32:01 -0000	1.20
+++ src/core/ipv6/ip6.c	9 Feb 2010 21:35:04 -0000
@@ -207,7 +207,7 @@
     return;
   }
 
-  pbuf_realloc(p, IP_HLEN + ntohs(iphdr->len));
+  pbuf_realloc(&p, IP_HLEN + ntohs(iphdr->len));
 
   /* send to upper layers */
 #if IP_DEBUG
Index: src/include/lwip/pbuf.h
===================================================================
RCS file: /sources/lwip/lwip/src/include/lwip/pbuf.h,v
retrieving revision 1.34
diff -u -r1.34 pbuf.h
--- src/include/lwip/pbuf.h	10 May 2009 17:07:26 -0000	1.34
+++ src/include/lwip/pbuf.h	9 Feb 2010 21:35:04 -0000
@@ -99,7 +99,7 @@
 #define pbuf_init()
 
 struct pbuf *pbuf_alloc(pbuf_layer l, u16_t size, pbuf_type type);
-void pbuf_realloc(struct pbuf *p, u16_t size); 
+void pbuf_realloc(struct pbuf **p, u16_t size); 
 u8_t pbuf_header(struct pbuf *p, s16_t header_size);
 void pbuf_ref(struct pbuf *p);
 void pbuf_ref_chain(struct pbuf *p);
Index: src/netif/slipif.c
===================================================================
RCS file: /sources/lwip/lwip/src/netif/slipif.c,v
retrieving revision 1.33
diff -u -r1.33 slipif.c
--- src/netif/slipif.c	4 Feb 2010 18:47:49 -0000	1.33
+++ src/netif/slipif.c	9 Feb 2010 21:35:04 -0000
@@ -179,7 +179,7 @@
         if (priv->recved > 0) {
           /* Received whole packet. */
           /* Trim the pbuf to the size of the received packet. */
-          pbuf_realloc(priv->q, priv->recved);
+          pbuf_realloc(&priv->q, priv->recved);
 
           LINK_STATS_INC(link.recv);
 
Index: src/netif/ppp/ppp.c
===================================================================
RCS file: /sources/lwip/lwip/src/netif/ppp/ppp.c,v
retrieving revision 1.45
diff -u -r1.45 ppp.c
--- src/netif/ppp/ppp.c	9 Feb 2010 18:21:21 -0000	1.45
+++ src/netif/ppp/ppp.c	9 Feb 2010 21:35:04 -0000
@@ -1820,7 +1820,7 @@
               pbuf_cat(pc->inHead, pc->inTail);
             }
 
-            pbuf_realloc(pc->inHead, pc->inHead->tot_len - 2);
+            pbuf_realloc(&pc->inHead, pc->inHead->tot_len - 2);
           }
 
           /* Dispatch the packet thereby consuming it. */
