buglwIP - A Lightweight TCP/IP stack - Bugs: bug #37853, Incoming packet with invalid ip...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #37853: Incoming packet with invalid ip header length causes assertion

Submitter:  Martin Sträng <mstrang>
Submitted:  Mon 03 Dec 2012 09:39:36 AM UTC
   
 
Category:  IPv4 Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Works For Me
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.4.0

Tue 20 May 2014 08:21:32 PM UTC, comment #2: 

No answer for more than a year.

Please reopen if you have more information.

Don't get me wrong, I'd love to run a hardening test on lwIP, but open bugs without more input (when needed) don't get us anywhere...

Simon Goldschmidt <goldsimon>
Group administrator
Tue 15 Jan 2013 07:41:22 PM UTC, comment #1: 

Can you provide an example packet leading to this assert? I tried but failed...
Which call to pbuf_header is it that triggers this?

> Maybe also add a check that: iphdr_hlen < IP_HLEN


Wouldn't that be wrong as iphdr_hlen includes options and is thus >= IP_HLEN?

Simon Goldschmidt <goldsimon>
Group administrator
Mon 03 Dec 2012 09:39:36 AM UTC, original submission:  

If an IP packet with an erroneous header length is sent to a DUT running lwip, this invalid header is caught by a LWIP_ERROR-check in the pbuf_header which in the default implementation leads to a platform_assert.

In this case the value of header length in the IP header is larger than the value of the total IP length.

In function ip_input, after pbuf_realloc has been called on line 375, there is a possibility that iphdh_hlen > pbuf->len. (This probably only occur if purposly erroneous packets are sent to the DUT).

My suggestion is to add another check on the header length according to the supplied patch in order to throw away this type of bad packets without getting caught in an assertion.

Maybe also add a check that: iphdr_hlen < IP_HLEN (Im not sure if this is already covered somewhere).

Martin Sträng <mstrang>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #27027:  ip4.patch added by mstrang (1KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by mstrang (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-05-21 goldsimon PrivacyPrivate Public
    2014-05-20 goldsimon StatusNeed Info Works For Me
        Open/ClosedOpen Closed
    2013-01-15 goldsimon StatusNone Need Info
        Assigned toNone goldsimon
    2012-12-03 mstrang Attached File- Added ip4.patch, #27027

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code