buglwIP - A Lightweight TCP/IP stack - Bugs: bug #57379, Assertion "Can't split...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57379: Assertion "Can't split segment into length 0" failed

Submitted by:  Hiromasa Ito <vhertz>
Submitted on:  Sat 07 Dec 2019 01:21:24 PM UTC  
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  Other

Sat 07 Dec 2019 01:21:24 PM UTC, original submission:  

Hi, all.

This is one of the assertion failures I found by fuzzing (to lwIP ver2.1.0.RC1).
The following LWIP_ASSERT() at lwip/src/core/tcp_out.c:851 fails.

if (split == 0) {
  LWIP_ASSERT("Can't split segment into length 0", 0);
  return ERR_VAL;
}

This code is written in tcp_split_unsent_seg(),
and that is called from tcp_slowtmr() as below:

if (tcp_split_unsent_seg(pcb, (u16_t)pcb->snd_wnd) == ERR_OK) {

The 2nd argument of tcp_split_unsent_seg() is `split`.
If LWIP_WND_SCALE is defined, `pcb->snd_wnd` has 32-bit value.
If the lower 16bit of it is 0x0000, the value of `split` becomes 0x0000.
For example, if the value of `pcb->snd_wnd` is 0xffff0000, that of `split` is 0x0000.

As a result, the assertion fails.

You can reproduce this failure with 'crashed_inputs/008', attached to the following message of lwip-devel:
https://lists.nongnu.org/archive/html/lwip-devel/2019-12/msg00013.html

Hiromasa Ito <vhertz>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by vhertz (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.5