lwIP - A Lightweight TCP/IP stack - Bugs: bug #22692, TCP: Header length not checked to...
You are not allowed to post comments on this tracker with your current authentication level.
bug #22692: TCP: Header length not checked to be > 20
Submitter: | Jared Grubb <jgrubb> | ||
Submitted: | Sat 22 Mar 2008 02:55:22 PM UTC | ||
Category: | TCP | Severity: | 6 - Security |
Item Group: | Faulty Behaviour | Status: | Invalid |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | None |
Mon 24 Mar 2008 05:00:43 PM UTC, comment #4: |
Frédéric Bernon <fbernon> |
Mon 24 Mar 2008 03:32:38 PM UTC, comment #3: The check Frederic mentions makes sure that there is room for a TCP header in general, but there is no explicit check that the field holding header length is valid (hdrlen must be >= 5). If hdrlen==0, for example, then the TCP header itself will be passed to the application/next layer as data.
|
Jared Grubb <jgrubb> |
Sat 22 Mar 2008 04:38:26 PM UTC, comment #2: I think it should be enough. |
Simon Goldschmidt <goldsimon> |
Sat 22 Mar 2008 03:58:46 PM UTC, comment #1: I'm not sure, but the check line ~112-113 does this :
|
Frédéric Bernon <fbernon> |
Sat 22 Mar 2008 02:55:22 PM UTC, original submission:
hdrlen = TCPH_HDRLEN(tcphdr);
|
Jared Grubb <jgrubb> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 2 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2008-03-23 | goldsimon | Status | None | Invalid | |
Open/Closed | Open | Closed |
Powered by Savane 3.13-3230.
Corresponding source code
Yes, it's true, but is it really one of the lwIP goal to check such values (this will increase -a little- the code size)? Of course, the fix should be easy ans small. What about other headers checking? Is there something like that for them ? It doesn't seem there is something like this (a minimal lenght checking) in ip_input.