lwIP - A Lightweight TCP/IP stack - Bugs: bug #53192, use-after-free in altcp_mbedtls
You are not allowed to post comments on this tracker with your current authentication level.
bug #53192: use-after-free in altcp_mbedtls
Submitter: | Simon Goldschmidt <goldsimon> | ||
Submitted: | Tue 20 Feb 2018 04:32:54 PM UTC | ||
Category: | None | Severity: | 3 - Normal |
Item Group: | Crash Error | Status: | Fixed |
Privacy: | Public | Assigned to: | goldsimon |
Open/Closed: | Closed | Planned Release: | 2.1.0 |
lwIP version: | git head |
Wed 21 Feb 2018 01:43:41 PM UTC, comment #2: |
Simon Goldschmidt <goldsimon> |
Tue 20 Feb 2018 07:20:39 PM UTC, comment #1: This is triggered by http_client over altcp_tls with MEMP_SANITY_CHECK==1. |
Simon Goldschmidt <goldsimon> |
Tue 20 Feb 2018 04:32:54 PM UTC, original submission:
When altcp_mbedtls_lower_recv() gets a NULL pbuf (closed indication) and passes this to an upper layer, this upper layer might close the connection but altcp_mbedtls_lower_recv() continues to use it and calls close itself. |
Simon Goldschmidt <goldsimon> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 3 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2018-02-21 | goldsimon | Status | None | Fixed | |
Open/Closed | Open | Closed | |||
2018-02-20 | goldsimon | Summary | use-after-free in | use-after-free in altcp_mbedtls |
Powered by Savane 3.13-caa5.
Corresponding source code
Fixed in 325cdf3c0bbb78d176e725fedeb105bb1cd5a858