lwIP - A Lightweight TCP/IP stack - Bugs: bug #53705, Buffer overflow in...
You are not allowed to post comments on this tracker with your current authentication level.
bug #53705: Buffer overflow in low_level_output in tapif.c (port for Unix)
Submitter: | Arkadiusz Wróbel <catsuryuu> | ||
Submitted: | Fri 20 Apr 2018 03:29:55 AM UTC | ||
Category: | Security-related | Severity: | 3 - Normal |
Item Group: | Faulty Behaviour | Status: | Fixed |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | git head |
Fri 20 Apr 2018 02:58:05 PM UTC, comment #2: |
Arkadiusz Wróbel <catsuryuu> |
Fri 20 Apr 2018 07:15:12 AM UTC, comment #1: Fixed, thanks for reporting.
|
Dirk Ziegelmeier <dziegel> |
Fri 20 Apr 2018 03:29:55 AM UTC, original submission:
'pbuf_copy_partial' should copy at most sizeof(buf) bytes.
|
Arkadiusz Wróbel <catsuryuu> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 4 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2018-04-25 | goldsimon | Open/Closed | Open | Closed | |
2018-04-22 | dziegel | Status | Ready For Test | Fixed | |
2018-04-20 | dziegel | Status | None | Ready For Test | |
2018-04-20 | catsuryuu | Attached File | - | Added ping6_2000.pcap, #43980 |
Powered by Savane 3.13-02a9.
Corresponding source code
You have to send a big Echo Request for ICMPv6 :)
I worked on 'echop' (compiled with LWIP_IPV6 and IPV6_FRAG_COPYHEADER). I left LWIP_IPV6_FRAG disabled.
I wanted to just use:
ping6 -I tap0 fe80::12:34ff:fe56:78ab -s 2000
but I have a problem with Neighbor Solicitation on tap0.
Should the server (echop) ask about ff02::1:ff40:5060 ?
I think it should be just ff02::1 (then everything works).
If I'm right I can make another submit with more details.
Anyway, I also attached a pcap file with my bug report.
There are three packets inside:
- two fragments of Echo Request for ICMPv6
- Neighbor Advertisement for the fake host (10:20:30:40:50:60)
I triggered the bug with them.