buglwIP - A Lightweight TCP/IP stack - Bugs: bug #23693, tcp_receive does not handle 'no...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #23693: tcp_receive does not handle 'no more segs available' from tcp_seg_copy

Submitter:  Art R. <tdir>
Submitted:  Tue 24 Jun 2008 02:40:17 PM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  jifl
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.3.0

Wed 25 Jun 2008 01:01:47 PM UTC, comment #5: 

This is correct. We should be dropping the new incoming seg and leaving the pcb->ooseq list as it was. Therefore we should not be changing it by calling tcp_seg_free(next), and doing so before was erroneous if cseg is NULL. So the fix described, and the fix checked in, are (I believe :-)) still correct.

Jonathan Larmour <jifl>
Group Member
Wed 25 Jun 2008 12:27:20 PM UTC, comment #4: 

There is a change in functionality with the proposed change.  If cseg is NULL, it's bypassing the

tcp_seg_free(next);

line which was done originally when cseg is NULL.

Bill Auerbach <billauerbach>
Tue 24 Jun 2008 03:49:46 PM UTC, comment #3: 

Mid-air collision here :)

Jonathan Larmour <jifl>
Group Member
Tue 24 Jun 2008 03:48:32 PM UTC, comment #2: 

Fix as proposed by Art R.:

Just replace the section in tcp_in.c @ 1190
                cseg = tcp_seg_copy(&inseg);
                if (cseg != NULL) {
                  cseg->next = next->next;
                  if (prev != NULL) {
                    prev->next = cseg;
                  } else {
                    pcb->ooseq = cseg;
                  }
                }
                tcp_seg_free(next);
                if (cseg->next != NULL) {
 
with (UNTESTED)
                cseg = tcp_seg_copy(&inseg);
                // If no seg available, do nothing.
                if (cseg == NULL) {
                    break;
                }
                // Insert the new seg
                cseg->next = next->next;
                if (prev != NULL) {
                  prev->next = cseg;
                } else {
                  pcb->ooseq = cseg;
                }
                // Release the old seg - it just got replaced with new one.
                tcp_seg_free(next);
                if (cseg->next != NULL) {

BTW: it's ok, you don't need to provide a patch. I will try to look into this.

Simon Goldschmidt <goldsimon>
Group administrator
Tue 24 Jun 2008 03:48:26 PM UTC, comment #1: 

I've looked at it carefully, and I'm happy applying a fix here (fatal last words), which I've now checked in.

Jonathan Larmour <jifl>
Group Member
Tue 24 Jun 2008 02:40:17 PM UTC, original submission:  

The function tcp_receive() in tcp_in.c can fail by dereferencing a NULL pointer if the seg pool has no more available segs. The code calls tcp_seg_copy() to get a seg but does not properly handle the case where a NULL result is returned (indicating there are no more available segs).

The correction would be to check the return value from tcp_seg_copy() and do nothing if no seg is obtained. The code currently does this partially but can still attempt to deref a NULL ptr. Doing so will probably crash the stack.

Relevant code (from tcp_in.c at about line 1190)
                cseg = tcp_seg_copy(&inseg);
                if (cseg != NULL) {
                  cseg->next = next->next;
                  if (prev != NULL) {
                    prev->next = cseg;
                  } else {
                    pcb->ooseq = cseg;
                  }
                }
                tcp_seg_free(next);
                if (cseg->next != NULL) { // cseg may be NULL



Art R. <tdir>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by billauerbach (Posted a comment)
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by jifl (Posted a comment)
  • -email is unavailable- added by tdir (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-06-24 jifl StatusNone Fixed
        Assigned toNone jifl
        Open/ClosedOpen Closed
    2008-06-24 goldsimon StatusFixed None
        Assigned tojifl None
        Open/ClosedClosed Open
    2008-06-24 jifl StatusNone Fixed
        Assigned toNone jifl
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code