patchlwIP - A Lightweight TCP/IP stack - Patches: patch #9209, udp/raw: prevent packet length...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #9209: udp/raw: prevent packet length overflows

Submitter:  David van Moolenbroek <dcvmoole>
Submitted:  Thu 05 Jan 2017 10:26:50 PM UTC
   
 
Category:  UDP Priority:  5 - Normal
Status:  Done Privacy:  Public
Assigned to:  goldsimon Open/Closed:  Closed
Planned Release:  None

Wed 08 Feb 2017 09:20:34 PM UTC, comment #1: 

Looks good -> pushed.
Thanks for sharing.

Simon Goldschmidt <goldsimon>
Group administrator
Thu 05 Jan 2017 10:26:50 PM UTC, original submission:  

Commit message reproduced below.

I'd be more confident if tot_len overflows were checked everywhere, but I understand that they are intentionally tolerated for TCP with window scaling. I /believe/ that the checks added by this patch are both complete for the problem at hand and not interfering with the TCP case. I have tested the former as well as I can, but I cannot test the latter.

FWIW, it looks like similar problems could be triggered at the ethernet level, but I think it's safe to assume that a reasonable MTU will prevent such cases there. More asserts would probably be nice, but at least the TCP window scaling case makes it hard to do that easily in a centralized place (eg pbuf_cat()).

===

Previously, on netifs with unrestricted MTUs (typically loopback interfaces), it was possible to give a packet to the UDP/RAW API calls that is so large that when prepending headers, the pbuf's tot_len field would overflow. This could easily result in undesirable behavior at lower layers, e.g. a crash when copying the packet for later delivery.

This patch models such overflows as memory allocation errors, thus resulting in clean failures. Checks have to be added in multiple places to cover (hopefully) all cases.

David van Moolenbroek <dcvmoole>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by dcvmoole (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-02-08 goldsimon StatusNone Done
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2017-01-05 dcvmoole Attached File- Added 0001-udp-raw-prevent-packet-length-overflows.patch, #39384

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code