buglwIP - A Lightweight TCP/IP stack - Bugs: bug #37705, Possible memory corruption in DNS...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #37705: Possible memory corruption in DNS query

Submitted by:  Florent Matignon <fmatignon>
Submitted on:  Fri 09 Nov 2012 06:15:48 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.3.1

Mon 14 Jan 2013 05:07:32 PM UTC, comment #3:

Fixed in master, thanks for reporting.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Thu 22 Nov 2012 05:37:48 PM UTC, comment #2:

Yes I retrieved most recent code using git, don't know why I wrote about csv head! ...

Florent Matignon <fmatignon>
Thu 22 Nov 2012 05:19:48 PM UTC, comment #1:

Without having had a look at the code, yet: are you aware we move to git a long time ago?

CVS HEAD is far from being up to date!

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 09 Nov 2012 06:15:48 PM UTC, original submission:

Hi,

There is a possible memory corruption when sending a DNS question (in dns_send function):

When building the packet, hostname is converted from string (passed as "name" parameter) to DNS format and DNS_MAX_NAME_LENGTH bytes are allocated in pbuf for this.

Hostname string may be up to DNS_MAX_NAME_LENGTH characters (final '\\0' included, according to strlen check in dns_gethostbyname and buffer allocation in dns_table_entry structure).

If the given hostname is exactly of the maximum allowed length, the hostname final '\\0' in packet is overwritten by DNS query type leading to packet corruption.

I'm using lwIP 1.3.2, but this issue seems to be still present on CSV head.

Florent Matignon <fmatignon>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by fmatignon (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 14 Jan 2013 05:07:32 PM UTCgoldsimonStatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1