buglwIP - A Lightweight TCP/IP stack - Bugs: bug #35151, DHCP asserts on incoming option...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #35151: DHCP asserts on incoming option lengths

Submitted by:  Erik Ekman <yarrick>
Submitted on:  Thu 22 Dec 2011 12:01:56 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.4.0

Fri 20 Jan 2012 08:37:05 PM UTC, comment #3:

Fixed

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 20 Jan 2012 06:40:31 AM UTC, comment #2:

I'll fix this for 1.4.1 (since the changes don't require me to do much work :-)

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 23 Dec 2011 08:29:10 AM UTC, comment #1:

Hmm, the asserts are meant to discover errors in the code. I see them as 'debug' asserts helping me to develop the code. We once had a long discussion which roughly ended in 'all asserts are for debugging only' and thus should be disabled in release mode.

I see your point, however. I guess I'll change the asserts to check-and-returns, then.

If you find other places like this one, let us know.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Thu 22 Dec 2011 12:01:56 PM UTC, original submission:

In dhcp_parse_reply() when parsing DHCP options the option lengths are checked with LWIP_ASSERT(). When asserts are enabled this means that someone can remotely hang the system running lwIP just by inserting bad DHCP packets.

The packet should just be dropped if any of the DHCP options have incorrect length.

This is present in 1.4.0 but also in latest git.

Erik Ekman <yarrick>
Project Member

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by yarrick (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 20 Jan 2012 08:37:05 PM UTCgoldsimonStatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed
    Fri 20 Jan 2012 06:40:31 AM UTCgoldsimonPlanned Release=>1.4.1

    Back to the top


    Powered by Savane 3.1-cleanup1