buglwIP - A Lightweight TCP/IP stack - Bugs: bug #39514, ip_route() may return an IPv6-only...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #39514: ip_route() may return an IPv6-only interface that will crash calling netif->output()

Submitter:  Christian Sasso <chris73it>
Submitted:  Thu 18 Jul 2013 04:47:46 AM UTC
   
 
Category:  IPv4 Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Tue 25 Feb 2014 09:38:20 PM UTC, comment #2: 

Fixed, thanks for reporting.

Simon Goldschmidt <goldsimon>
Group administrator
Fri 19 Jul 2013 06:02:55 PM UTC, comment #1: 

Thanks for posting, will look into it and hopefully merge soon.

Ivan Delamer <idelamer>
Group Member
Thu 18 Jul 2013 04:47:46 AM UTC, original submission:  

When netif_list contains at least an IPv6-only interface that is up, the ip_route() function may return such interface since its netmask is 0, and the condition inside the for-loop:
  (ip_addr_netcmp(dest, &(netif->ip_addr), &(netif->netmask)))
is always true, irrespective of the value of dest.
Eventually LwIP crashes attempting to call netif->output() on the interface returned by ip_route().

This patch works for me:
diff --git a/src/core/ipv4/ip4.c b/src/core/ipv4/ip4.c
index 4b38999..decf8c4 100644
--- a/src/core/ipv4/ip4.c
+++ b/src/core/ipv4/ip4.c
@@ -123,7 +123,11 @@ ip_route(ip_addr_t *dest)
   /* iterate through netifs */
   for (netif = netif_list; netif != NULL; netif = netif->next) {
     /* network mask matches? */
-    if (netif_is_up(netif)) {
+    if ((netif_is_up(netif))
+#if LWIP_IPV6
+      && (!ip_addr_isany(&(netif->ip_addr)))
+#endif /* LWIP_IPV6 */
+    ) {
       if (ip_addr_netcmp(dest, &(netif->ip_addr), &(netif->netmask))) {
         /* return netif on which to forward IP packet */
         return netif;

Christian Sasso <chris73it>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by idelamer (Posted a comment)
  • -email is unavailable- added by chris73it (Submitted the item)
  • -email is unavailable- added by chris73it
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-02-25 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
        Planned Release 1.5.0
    2013-07-18 chris73it Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code