buglwIP - A Lightweight TCP/IP stack - Bugs: bug #23693, tcp_receive does not handle 'no...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #23693: tcp_receive does not handle 'no more segs available' from tcp_seg_copy

Submitted by:  Art R. <tdir>
Submitted on:  Tue 24 Jun 2008 02:40:17 PM UTC  
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  Jonathan Larmour <jifl>
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.3.0

Wed 25 Jun 2008 01:01:47 PM UTC, comment #5: 

This is correct. We should be dropping the new incoming seg and leaving the pcb->ooseq list as it was. Therefore we should not be changing it by calling tcp_seg_free(next), and doing so before was erroneous if cseg is NULL. So the fix described, and the fix checked in, are (I believe :-)) still correct.

Jonathan Larmour <jifl>
Project MemberIn charge of this item.
Wed 25 Jun 2008 12:27:20 PM UTC, comment #4: 

There is a change in functionality with the proposed change.  If cseg is NULL, it's bypassing the

tcp_seg_free(next);

line which was done originally when cseg is NULL.

Bill Auerbach <billauerbach>
Tue 24 Jun 2008 03:49:46 PM UTC, comment #3: 

Mid-air collision here :)

Jonathan Larmour <jifl>
Project MemberIn charge of this item.
Tue 24 Jun 2008 03:48:32 PM UTC, comment #2: 

Fix as proposed by Art R.:

Just replace the section in tcp_in.c @ 1190
                cseg = tcp_seg_copy(&inseg);
                if (cseg != NULL) {
                  cseg->next = next->next;
                  if (prev != NULL) {
                    prev->next = cseg;
                  } else {
                    pcb->ooseq = cseg;
                  }
                }
                tcp_seg_free(next);
                if (cseg->next != NULL) {

with (UNTESTED)
                cseg = tcp_seg_copy(&inseg);
                // If no seg available, do nothing.
                if (cseg == NULL) {
                    break;
                }
                // Insert the new seg
                cseg->next = next->next;
                if (prev != NULL) {
                  prev->next = cseg;
                } else {
                  pcb->ooseq = cseg;
                }
                // Release the old seg - it just got replaced with new one.
                tcp_seg_free(next);
                if (cseg->next != NULL) {

BTW: it's ok, you don't need to provide a patch. I will try to look into this.

Simon Goldschmidt <goldsimon>
Project Administrator
Tue 24 Jun 2008 03:48:26 PM UTC, comment #1: 

I've looked at it carefully, and I'm happy applying a fix here (fatal last words), which I've now checked in.

Jonathan Larmour <jifl>
Project MemberIn charge of this item.
Tue 24 Jun 2008 02:40:17 PM UTC, original submission:  

The function tcp_receive() in tcp_in.c can fail by dereferencing a NULL pointer if the seg pool has no more available segs. The code calls tcp_seg_copy() to get a seg but does not properly handle the case where a NULL result is returned (indicating there are no more available segs).

The correction would be to check the return value from tcp_seg_copy() and do nothing if no seg is obtained. The code currently does this partially but can still attempt to deref a NULL ptr. Doing so will probably crash the stack.

Relevant code (from tcp_in.c at about line 1190)
                cseg = tcp_seg_copy(&inseg);
                if (cseg != NULL) {
                  cseg->next = next->next;
                  if (prev != NULL) {
                    prev->next = cseg;
                  } else {
                    pcb->ooseq = cseg;
                  }
                }
                tcp_seg_free(next);
                if (cseg->next != NULL) { // cseg may be NULL

Art R. <tdir>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by billauerbach (Posted a comment)
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by jifl (Posted a comment)
  • -email is unavailable- added by tdir (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-06-24 jifl StatusNone => Fixed
        Assigned toNone => jifl
        Open/ClosedOpen => Closed
    2008-06-24 goldsimon StatusFixed => None
        Assigned tojifl => None
        Open/ClosedClosed => Open
    2008-06-24 jifl StatusNone => Fixed
        Assigned toNone => jifl
        Open/ClosedOpen => Closed

    Back to the top


    Powered by Savane 3.5