buglwIP - A Lightweight TCP/IP stack - Bugs: bug #37705, Possible memory corruption in DNS...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #37705: Possible memory corruption in DNS query

Submitter:  Florent Matignon <fmatignon>
Submitted:  Fri 09 Nov 2012 06:15:48 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.3.1

Mon 14 Jan 2013 05:07:32 PM UTC, comment #3: 

Fixed in master, thanks for reporting.

Simon Goldschmidt <goldsimon>
Group administrator
Thu 22 Nov 2012 05:37:48 PM UTC, comment #2: 

Yes I retrieved most recent code using git, don't know why I wrote about csv head! ...

Florent Matignon <fmatignon>
Thu 22 Nov 2012 05:19:48 PM UTC, comment #1: 

Without having had a look at the code, yet: are you aware we move to git a long time ago?

CVS HEAD is far from being up to date!

Simon Goldschmidt <goldsimon>
Group administrator
Fri 09 Nov 2012 06:15:48 PM UTC, original submission:  

Hi,

There is a possible memory corruption when sending a DNS question (in dns_send function):

When building the packet, hostname is converted from string (passed as "name" parameter) to DNS format and DNS_MAX_NAME_LENGTH bytes are allocated in pbuf for this.

Hostname string may be up to DNS_MAX_NAME_LENGTH characters (final '\\0' included, according to strlen check in dns_gethostbyname and buffer allocation in dns_table_entry structure).

If the given hostname is exactly of the maximum allowed length, the hostname final '\\0' in packet is overwritten by DNS query type leading to packet corruption.

I'm using lwIP 1.3.2, but this issue seems to be still present on CSV head.

Florent Matignon <fmatignon>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by fmatignon (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-01-14 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code