buglwIP - A Lightweight TCP/IP stack - Bugs: bug #37853, Incoming packet with invalid ip...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #37853: Incoming packet with invalid ip header length causes assertion

Submitted by:  Martin Sträng <mstrang>
Submitted on:  Mon 03 Dec 2012 09:39:36 AM UTC  
 
Category: IPv4Severity: 3 - Normal
Item Group: Faulty BehaviourStatus: Works For Me
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.4.0

Tue 20 May 2014 08:21:32 PM UTC, comment #2:

No answer for more than a year.

Please reopen if you have more information.

Don't get me wrong, I'd love to run a hardening test on lwIP, but open bugs without more input (when needed) don't get us anywhere...

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 15 Jan 2013 07:41:22 PM UTC, comment #1:

Can you provide an example packet leading to this assert? I tried but failed...
Which call to pbuf_header is it that triggers this?

> Maybe also add a check that: iphdr_hlen < IP_HLEN


Wouldn't that be wrong as iphdr_hlen includes options and is thus >= IP_HLEN?

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Mon 03 Dec 2012 09:39:36 AM UTC, original submission:

If an IP packet with an erroneous header length is sent to a DUT running lwip, this invalid header is caught by a LWIP_ERROR-check in the pbuf_header which in the default implementation leads to a platform_assert.

In this case the value of header length in the IP header is larger than the value of the total IP length.

In function ip_input, after pbuf_realloc has been called on line 375, there is a possibility that iphdh_hlen > pbuf->len. (This probably only occur if purposly erroneous packets are sent to the DUT).

My suggestion is to add another check on the header length according to the supplied patch in order to throw away this type of bad packets without getting caught in an assertion.

Maybe also add a check that: iphdr_hlen < IP_HLEN (Im not sure if this is already covered somewhere).

Martin Sträng <mstrang>

 

Attached Files
file #27027:  ip4.patch added by mstrang (1KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by mstrang (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 21 May 2014 04:21:20 AM UTCgoldsimonPrivacyPrivate=>Public
    Tue 20 May 2014 08:21:32 PM UTCgoldsimonStatusNeed Info=>Works For Me
      Open/ClosedOpen=>Closed
    Tue 15 Jan 2013 07:41:22 PM UTCgoldsimonStatusNone=>Need Info
      Assigned toNone=>goldsimon
    Mon 03 Dec 2012 09:39:36 AM UTCmstrangAttached File-=>Added ip4.patch, #27027

    Back to the top


    Powered by Savane 3.1-cleanup1