buglwIP - A Lightweight TCP/IP stack - Bugs: bug #57375, Assertion "mss_local is too...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57375: Assertion "mss_local is too small" failed

Submitted by:  Hiromasa Ito <vhertz>
Submitted on:  Sat 07 Dec 2019 01:13:38 PM UTC  
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  Other

Mon 29 Jun 2020 08:00:10 PM UTC, comment #1: 

I can reproduce this with the latest code by simulating the old rand implementation:

$ cd test/fuzz
$ make all D="-DLWIP_RAND_FOR_FUZZ_SIMULATE_GLIBC"
$ ./lwip_fuzz3 crashed_inputs/004
reading input from file... testing file: "crashed_inputs/004"...
Assertion "mss_local is too small" failed at line 486 in ../../src/core/tcp_out.c
Aborted (core dumped)

The relevant code was changed in fixing bug #25882, bug #36153 and bug #37184, so any fix must be carefully designed.

Erik Ekman <yarrick>
Project Member
Sat 07 Dec 2019 01:13:38 PM UTC, original submission:  

Hi, all.

This is one of the assertion failures I found by fuzzing (to lwIP ver2.1.0.RC1).
The following LWIP_ASSERT() at lwip/src/core/tcp_out.c:486 fails.

LWIP_ASSERT("mss_local is too small", mss_local >= last_unsent->len + unsent_optlen);

As described in the assertion, too small MSS causes this failure.
Incomming packets can set MSS in the range of 0 < MSS < TCP_MSS.
At tcp_in.c:1943, pcb->mss is set as below without any other validation:

pcb->mss = ((mss > TCP_MSS) || (mss == 0)) ? TCP_MSS : mss;

You can reproduce this failure with 'crashed_inputs/004' attached to the following message of lwip-devel:
https://lists.nongnu.org/archive/html/lwip-devel/2019-12/msg00013.html

Hiromasa Ito <vhertz>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yarrick (Posted a comment)
  • -email is unavailable- added by vhertz (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.5