buglwIP - A Lightweight TCP/IP stack - Bugs: bug #38153, nd6_input() byte order issues

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #38153: nd6_input() byte order issues

Submitter:  Zach Smith <zsmith>
Submitted:  Wed 23 Jan 2013 08:13:24 PM UTC
   
 
Category:  IPv6 Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Wed 04 Mar 2015 07:49:38 PM UTC, comment #2: 

Verified on Win32 and fixed. Thanks for the patch.

Simon Goldschmidt <goldsimon>
Group administrator
Fri 28 Jun 2013 07:55:24 PM UTC, comment #1: 

Always a big problem: we need both little-endian and big-endian platform to test this.

Simon Goldschmidt <goldsimon>
Group administrator
Wed 23 Jan 2013 08:13:24 PM UTC, original submission:  

nd6_input() seems to have some byte order access issues.  There are a few header accesses that should use ntohs() or ntohl().  Here are the ones that I found:
(attached file with these changes)

-- Line 396: --
default_router_list[i].invalidation_timer = ra_hdr->router_lifetime;
should be:
default_router_list[i].invalidation_timer = ntohs(ra_hdr->router_lifetime);


-- Line 400-405: --
if (ra_hdr->retrans_timer > 0) {
  retrans_timer = ra_hdr->retrans_timer;
}
if (ra_hdr->reachable_time > 0) {
  reachable_time = ra_hdr->reachable_time;
}
should be:
if (ntohl(ra_hdr->retrans_timer) > 0) {
  retrans_timer = ntohl(ra_hdr->retrans_timer);
}
if (ntohl(ra_hdr->reachable_time) > 0) {
  reachable_time = ntohl(ra_hdr->reachable_time);
}


-- Line 441-447: --
struct mtu_option * mtu_opt;
mtu_opt = (struct mtu_option *)buffer;
if (mtu_opt->mtu >= 1280) {
#if LWIP_ND6_ALLOW_RA_UPDATES
    inp->mtu = mtu_opt->mtu;
#endif /* LWIP_ND6_ALLOW_RA_UPDATES */
}
should be:
struct mtu_option * mtu_opt;
mtu_opt = (struct mtu_option *)buffer;
if (ntohl(mtu_opt->mtu) >= 1280) {
#if LWIP_ND6_ALLOW_RA_UPDATES
    inp->mtu = ntohl(mtu_opt->mtu);
#endif /* LWIP_ND6_ALLOW_RA_UPDATES */
}


-- Line 468: --
prefix_list[i].invalidation_timer = prefix_opt->valid_lifetime;
should be:
prefix_list[i].invalidation_timer = ntohl(prefix_opt->valid_lifetime);


-- Line 597: --
destination_cache[i].pmtu = icmp6hdr->data;
should be
destination_cache[i].pmtu = ntohl(icmp6hdr->data);

Zach Smith <zsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #32624:  nd6_byte_order_issues.patch added by zsmith (2KiB - application/octet-stream - added patch file)
file #27318:  nd6.c added by zsmith (59KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by zsmith (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-03-04 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2014-12-09 zsmith Attached File- Added nd6_byte_order_issues.patch, #32624
    2013-06-28 goldsimon Planned Release 1.5.0 beta1
    2013-01-23 zsmith Attached File- Added nd6.c, #27318

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code