buglwIP - A Lightweight TCP/IP stack - Bugs: bug #23693, tcp_receive does not handle 'no...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #23693: tcp_receive does not handle 'no more segs available' from tcp_seg_copy

Submitted by:  Art R. <tdir>
Submitted on:  Tue 24 Jun 2008 02:40:17 PM UTC  
 
Category: TCPSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Fixed
Privacy: PublicAssigned to: Jonathan Larmour <jifl>
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.3.0

Wed 25 Jun 2008 01:01:47 PM UTC, comment #5:

This is correct. We should be dropping the new incoming seg and leaving the pcb->ooseq list as it was. Therefore we should not be changing it by calling tcp_seg_free(next), and doing so before was erroneous if cseg is NULL. So the fix described, and the fix checked in, are (I believe :-)) still correct.

Jonathan Larmour <jifl>
Project MemberIn charge of this item.
Wed 25 Jun 2008 12:27:20 PM UTC, comment #4:

There is a change in functionality with the proposed change. If cseg is NULL, it's bypassing the

tcp_seg_free(next);

line which was done originally when cseg is NULL.

Bill Auerbach <billauerbach>
Tue 24 Jun 2008 03:49:46 PM UTC, comment #3:

Mid-air collision here :)

Jonathan Larmour <jifl>
Project MemberIn charge of this item.
Tue 24 Jun 2008 03:48:32 PM UTC, comment #2:

Fix as proposed by Art R.:

Just replace the section in tcp_in.c @ 1190
cseg = tcp_seg_copy(&inseg);
if (cseg != NULL) {
cseg->next = next->next;
if (prev != NULL) {
prev->next = cseg;
} else {
pcb->ooseq = cseg;
}
}
tcp_seg_free(next);
if (cseg->next != NULL) {

with (UNTESTED)
cseg = tcp_seg_copy(&inseg);
// If no seg available, do nothing.
if (cseg == NULL) {
break;
}
// Insert the new seg
cseg->next = next->next;
if (prev != NULL) {
prev->next = cseg;
} else {
pcb->ooseq = cseg;
}
// Release the old seg - it just got replaced with new one.
tcp_seg_free(next);
if (cseg->next != NULL) {

BTW: it's ok, you don't need to provide a patch. I will try to look into this.

Simon Goldschmidt <goldsimon>
Project Administrator
Tue 24 Jun 2008 03:48:26 PM UTC, comment #1:

I've looked at it carefully, and I'm happy applying a fix here (fatal last words), which I've now checked in.

Jonathan Larmour <jifl>
Project MemberIn charge of this item.
Tue 24 Jun 2008 02:40:17 PM UTC, original submission:

The function tcp_receive() in tcp_in.c can fail by dereferencing a NULL pointer if the seg pool has no more available segs. The code calls tcp_seg_copy() to get a seg but does not properly handle the case where a NULL result is returned (indicating there are no more available segs).

The correction would be to check the return value from tcp_seg_copy() and do nothing if no seg is obtained. The code currently does this partially but can still attempt to deref a NULL ptr. Doing so will probably crash the stack.

Relevant code (from tcp_in.c at about line 1190)
cseg = tcp_seg_copy(&inseg);
if (cseg != NULL) {
cseg->next = next->next;
if (prev != NULL) {
prev->next = cseg;
} else {
pcb->ooseq = cseg;
}
}
tcp_seg_free(next);
if (cseg->next != NULL) { // cseg may be NULL

Art R. <tdir>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by billauerbach (Posted a comment)
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by jifl (Posted a comment)
  • -unavailable- added by tdir (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 24 Jun 2008 03:50:04 PM UTCjiflStatusNone=>Fixed
      Assigned toNone=>jifl
      Open/ClosedOpen=>Closed
    Tue 24 Jun 2008 03:48:32 PM UTCgoldsimonStatusFixed=>None
      Assigned tojifl=>None
      Open/ClosedClosed=>Open
    Tue 24 Jun 2008 03:48:26 PM UTCjiflStatusNone=>Fixed
      Assigned toNone=>jifl
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1