buglwIP - A Lightweight TCP/IP stack - Bugs: bug #23947, ...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #23947: ip_reass_chain_frag_into_datagram_and_validate() wrongly cast to incompatible pointer

Submitted by:  Huang Po Sung <geminicat>
Submitted on:  Mon 28 Jul 2008 09:53:26 AM UTC  
 
Category: IPv4Severity: 3 - Normal
Item Group: Crash ErrorStatus: Invalid
Privacy: PublicAssigned to: None
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.3.0

Mon 28 Jul 2008 10:59:38 AM UTC, comment #2:

I think I misunderstand the code. The cast is not the real problem I met. My system crashed on something else about data alignment and crashed on those codes.

These codes are ok. Sorry for your inconvenient.

Huang Po Sung <geminicat>
Mon 28 Jul 2008 10:25:41 AM UTC, comment #1:

Can you clarify if this is an actual problem you have seen or just from reading the code? If an actual problem, can you provide details of what happened?

Kieran Mansley <kieranm>
Project Administrator
Mon 28 Jul 2008 09:53:26 AM UTC, original submission:

There is a serious bug in ip_reass_chain_frag_into_datagram_and_validate() of ip_frag.c. Just few lines after the function start:
.
.
.
1. iprh = (struct ip_reass_helper*)new_p->payload;
2. iprh->next_pbuf = NULL;
3. iprh->start = offset;
4. iprh->end = offset + len;

The "new_p->payload" is a pointer to the actual IP frame data. How can you just cast it into (struct ip_reass_helper *) as line 1 shows, and write unmactch structure value into it, as line 2~4 show?

Whenever there is a reassemble needs, these codes will destroy the real IP data and cause system malfunction or even crash.

Huang Po Sung <geminicat>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by kieranm (Posted a comment)
  • -unavailable- added by geminicat (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 28 Jul 2008 11:35:23 AM UTCkieranmStatusNone=>Invalid
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1