buglwIP - A Lightweight TCP/IP stack - Bugs: bug #24228, Memory Corruption with PPP and DHCP

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #24228: Memory Corruption with PPP and DHCP

Submitter:  Christophe Arzounian <carzounian>
Submitted:  Tue 09 Sep 2008 01:24:38 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.3.0

Fri 01 May 2009 11:42:56 AM UTC, comment #1: 

I'm really sorry this one got no attention at all yet, but it seems there are still no active developers using PPP.

However, I had a look through the PPP files, and since the netif->dhcp pointer is used nowhere else, these lines cannot be useful: the info is stored there but never read from there!

These lines have been introduced with ppp.c v1.14, when PPPoE was added by Marc Boucher. Unfortunately, I don't know what he wanted to achieve with it, but I think we can safely remove the lines without any replacement.

I've done that now, please cry out if that's wrong.

Simon Goldschmidt <goldsimon>
Group administrator
Tue 09 Sep 2008 01:24:38 PM UTC, original submission:  

When using PPP with LWIP_DHCP flag set to ON, data situated after the static structure "pppControl" (the PPP context) are corrupted when dhcp function "dhcp_coarse_tmr" is executed. This function writes into the dhcp context associated with the used netifs. For PPP the dhcp context has savagely been mapped to the "addrs" structure of the ppp context (see below : line 1344 of ppp.c), which is too small to contain all of the fields of a dhcp context.

1342 #if LWIP_DHCP
1343       /* ugly workaround for storing a reference to the ppp  related info*/
1345      pc->netif.dhcp = (struct dhcp *) &pc->addrs;
#endif /* LWIP_DHCP */

In my case, when the "dhcp_coarse_tmr" function writes to the "t1_timeout" field of the dhcp context associated with the PPP netif, it destroys important data located after the pppControl structure.


Suggested solutions :

As I also use other netifs that need DHCP to be activated, I can not just set LWIP_DHCP to OFF.

Suggestion 1 :
Why not set to NULL the dhcp poiter of the PPP netif ? Is there any need for DHCP with the PPP netif ?
I did not try this solution - I am not confident enough about the answer to this question.

Suggestion 2 :
When flag LWIP_DHCP is on, why not declare a structure ppp_dhcp inside "struct PPPControl_s" and set pointer netif.dhcp of the PPP context to the address of the ppp_dhcp structure instead of the address of the "addrs" structure.
This solution seems to work fine.




Christophe Arzounian <carzounian>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by carzounian (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-05-01 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-bb6a.
    Corresponding source code