buglwIP - A Lightweight TCP/IP stack - Bugs: bug #54744, if altcp_close() called from...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #54744: if altcp_close() called from recv() callback, there is some write to freed memory

Submitter:  David GIRAULT <dgirault>
Submitted:  Thu 27 Sep 2018 03:07:36 PM UTC
   
 
Category:  Security-related Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  2.1.1
lwIP version:  git head

Fri 26 Oct 2018 05:58:28 PM UTC, comment #3: 

Ok, sorry for taking nearly a month. Finally found the time to review this.

Pushed, thanks for the patch.

Simon Goldschmidt <goldsimon>
Group administrator
Wed 03 Oct 2018 01:18:58 PM UTC, comment #2: 

I've added a patch applied against current master (don't have time to review it right now, especially the part that checks if the app has called close...)

(file #45130)

Simon Goldschmidt <goldsimon>
Group administrator
Thu 27 Sep 2018 03:23:16 PM UTC, comment #1: 

Sorry for the patch, not in good format nor made against upstream/master.

David GIRAULT <dgirault>
Thu 27 Sep 2018 03:07:36 PM UTC, original submission:  

When altcp_close() is called from the recv() handler installed by application for an altcp mbedtls socket, the following problem occurs:

- in altcp_mbedtls_pass_rx_data(), state isn't valid anymore after conn->recv() call, so it must not write null to state->rx_app.

- in altcp_mbedtls_handle_rx_appldata(), which call altcp_mbedtls_pass_rx_data(), state may not be valid after this call. So loop must be breaked.


David GIRAULT <dgirault>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #45130:  0001-bug-54744.patch added by goldsimon (2KiB - application/octet-stream)
file #45106:  altcp_tls_mbedtls.patch added by dgirault (2KiB - text/x-patch - Patch for altcp_mbedtls_pass_rx_data() function)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Updated the item)
  • -email is unavailable- added by dgirault (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-10-26 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2018-10-03 goldsimon Attached File- Added 0001-bug-54744.patch, #45130
    2018-09-28 goldsimon Planned ReleaseNone 2.1.1
    2018-09-27 dgirault Attached File- Added altcp_tls_mbedtls.patch, #45106

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code