buglwIP - A Lightweight TCP/IP stack - Bugs: bug #35151, DHCP asserts on incoming option...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #35151: DHCP asserts on incoming option lengths

Submitter:  Erik Ekman <yarrick>
Submitted:  Thu 22 Dec 2011 12:01:56 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.4.0

Fri 20 Jan 2012 08:37:05 PM UTC, comment #3: 

Fixed

Simon Goldschmidt <goldsimon>
Group administrator
Fri 20 Jan 2012 06:40:31 AM UTC, comment #2: 

I'll fix this for 1.4.1 (since the changes don't require me to do much work :-)

Simon Goldschmidt <goldsimon>
Group administrator
Fri 23 Dec 2011 08:29:10 AM UTC, comment #1: 

Hmm, the asserts are meant to discover errors in the code. I see them as 'debug' asserts helping me to develop the code. We once had a long discussion which roughly ended in 'all asserts are for debugging only' and thus should be disabled in release mode.

I see your point, however. I guess I'll change the asserts to check-and-returns, then.

If you find other places like this one, let us know.

Simon Goldschmidt <goldsimon>
Group administrator
Thu 22 Dec 2011 12:01:56 PM UTC, original submission:  

In dhcp_parse_reply() when parsing DHCP options the option lengths are checked with LWIP_ASSERT(). When asserts are enabled this means that someone can remotely hang the system running lwIP just by inserting bad DHCP packets.

The packet should just be dropped if any of the DHCP options have incorrect length.

This is present in 1.4.0 but also in latest git.

Erik Ekman <yarrick>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by yarrick (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-01-20 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2012-01-20 goldsimon Planned Release 1.4.1

    Back to the top

    Powered by Savane 3.12