buglwIP - A Lightweight TCP/IP stack - Bugs: bug #55706, LWIP_ASSERT in tcp_receive fails

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #55706: LWIP_ASSERT in tcp_receive fails

Submitted by:  Hiromasa Ito <vhertz>
Submitted on:  Wed 13 Feb 2019 09:02:35 AM UTC  
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  git head

Wed 01 Jul 2020 06:44:37 PM UTC, comment #1: 

I believe this is triggered by the input 002 from https://lists.nongnu.org/archive/html/lwip-devel/2019-12/msg00013.html

Erik Ekman <yarrick>
Project Member
Wed 13 Feb 2019 09:02:35 AM UTC, original submission:  

Hi, all.

I found a testcase fails in LWIP_ASSERT in tcp_receive().
(by fuzzing with AFL)

The LWIP_ASSERT is at tcp_in.c:1532 in lwIP v2.1.2.

This if-block includes the LWIP_ASSERT.

/* --- code snippet start  --- */

if (next &&
    TCP_SEQ_GT(seqno + tcplen,
               next->tcphdr->seqno)) {

  inseg.len = (u16_t)(next->tcphdr->seqno - seqno);
  if (TCPH_FLAGS(inseg.tcphdr) & TCP_SYN) {
    inseg.len -= 1;
  }
  pbuf_realloc(inseg.p, inseg.len);
  tcplen = TCP_TCPLEN(&inseg);

  /* fails this assertion */
  LWIP_ASSERT("tcp_receive: segment not trimmed correctly to ooseq queue\n",
              (seqno + tcplen) == next->tcphdr->seqno);
}

/* --- code snippet end --- */

In the testcase, arguments of assertion were as below.

seqno               : 0x93d897e7
tcplen              : 0xffff

next->tcphdr->seqno : 0x93d897e6

and, the value of tcplen before the block was 0x0001.

inseg.len is assigned to tcplen.
(next->tcphdr->seqno - seqno) is assigned to inseg.len.

In this case, the value of (next->tcphdr->seqno - seqno) is 0xffffffff.
So, this value is out of range of u16_t.

I think, we need to add some other validation checks.

Hiromasa Ito <vhertz>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yarrick (Posted a comment)
  • -email is unavailable- added by vhertz (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.5