buglwIP - A Lightweight TCP/IP stack - Bugs: bug #39956, netif_create_ip6_linklocal_address...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #39956: netif_create_ip6_linklocal_address out of bounds access of netif::hwaddr

Submitter:  Valery Ushakov <uwe>
Submitted:  Thu 05 Sep 2013 05:27:49 PM UTC
   
 
Category:  IPv6 Severity:  3 - Normal
Item Group:  Compiler Warning Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Wed 04 Mar 2015 07:58:55 PM UTC, comment #3: 

Fixed, thanks for reporting.

Simon Goldschmidt <goldsimon>
Group administrator
Mon 25 Aug 2014 04:04:35 PM UTC, comment #2: 

Thanks for posting, I get this warning too so I'll try to merge the fix.

Ivan Delamer <idelamer>
Group Member
Sun 24 Aug 2014 10:40:03 PM UTC, comment #1: 

gcc with certain options will warn on this overflow, eg:


arm-none-eabi-gcc -Idist/laureline-v3.0-13-g8a7d4f6-dirty -Isrc -Isrc/conf -I./lib -I./lib/lwip -I./ports -I./CoOS/kernel -I./CoOS/portable -I./lwip/src/include -I./lwip/src/include/ipv4 -I./lwip/src/include/ipv6 -Wall -Wextra -Wstrict-prototypes -Wno-unused-parameter -Wno-main -Wno-address -mcpu=cortex-m3 -mthumb -mno-thumb-interwork -DTHUMB_NO_INTERWORKING -Os -fomit-frame-pointer -Werror -ggdb3 -MD -MP -MF dist/laureline-v3.0-13-g8a7d4f6-dirty/./lwip/src/core/netif.o.d -ffunction-sections -fdata-sections -fno-common -falign-functions=16 lwip/src/core/netif.c -c -o dist/laureline-v3.0-13-g8a7d4f6-dirty/./lwip/src/core/netif.o
lwip/src/core/netif.c: In function 'netif_create_ip6_linklocal_address':
lwip/src/core/netif.c:917:68: error: iteration 6u invokes undefined behavior [-Werror=aggressive-loop-optimizations]
       netif->ip6_addr[0].addr[addr_index] |= ((u32_t)(netif->hwaddr[netif->hwaddr_len - i - 1])) << (8 * (i & 0x03));
                                                                    ^
lwip/src/core/netif.c:913:5: note: containing loop
     for (i = 0; i < 8; i++) {
     ^
cc1: all warnings being treated as errors


It's entirely because of the incorrect assumption on the size of hwaddr.

This possibly naive diff resolves the compiler issue:


diff --git a/src/core/netif.c b/src/core/netif.c
index 36e801b..d655471 100644
--- a/src/core/netif.c
+++ b/src/core/netif.c
@@ -910,7 +910,7 @@ netif_create_ip6_linklocal_address(struct netif * netif, u8_t from_mac_48bit)
     netif->ip6_addr[0].addr[3] = 0;

     addr_index = 3;
-    for (i = 0; i < 8; i++) {
+    for (i = 0; i < netif->hwaddr_len; i++) {
       if (i == 4) {
         addr_index--;
       }


But, like the rest of that loop, it assumes the lower half of the address is all 0 already.

Chris Luke <chrisy>
Thu 05 Sep 2013 05:27:49 PM UTC, original submission:  

In the !from_mac_48bit case hwaddr is read in a loop from 0 to 7 as netif->hwaddr[netif->hwaddr_len - i - 1] and no check is done if hwaddr_len is large enough.

NETIF_MAX_HWADDR_LEN is 6 by default, so the above loop reads from hwaddr out of bounds.

Valery Ushakov <uwe>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by idelamer (Posted a comment)
  • -email is unavailable- added by chrisy (Posted a comment)
  • -email is unavailable- added by goldsimon (Updated the item)
  • -email is unavailable- added by uwe (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-03-04 goldsimon StatusConfirmed Fixed
        Assigned toidelamer goldsimon
        Open/ClosedOpen Closed
    2014-08-25 idelamer Item GroupFaulty Behaviour Compiler Warning
        StatusNone Confirmed
        Assigned toNone idelamer
    2014-02-20 goldsimon CategoryNone IPv6

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code