buglwIP - A Lightweight TCP/IP stack - Bugs: bug #38153, nd6_input() byte order issues

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #38153: nd6_input() byte order issues

Submitted by:  Zach Smith <zsmith>
Submitted on:  Wed 23 Jan 2013 08:13:24 PM UTC  
 
Category: IPv6Severity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: git head

Wed 04 Mar 2015 07:49:38 PM UTC, comment #2:

Verified on Win32 and fixed. Thanks for the patch.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 28 Jun 2013 07:55:24 PM UTC, comment #1:

Always a big problem: we need both little-endian and big-endian platform to test this.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 23 Jan 2013 08:13:24 PM UTC, original submission:

nd6_input() seems to have some byte order access issues. There are a few header accesses that should use ntohs() or ntohl(). Here are the ones that I found:
(attached file with these changes)

-- Line 396: --
default_router_list[i].invalidation_timer = ra_hdr->router_lifetime;
should be:
default_router_list[i].invalidation_timer = ntohs(ra_hdr->router_lifetime);

-- Line 400-405: --
if (ra_hdr->retrans_timer > 0) {
retrans_timer = ra_hdr->retrans_timer;
}
if (ra_hdr->reachable_time > 0) {
reachable_time = ra_hdr->reachable_time;
}
should be:
if (ntohl(ra_hdr->retrans_timer) > 0) {
retrans_timer = ntohl(ra_hdr->retrans_timer);
}
if (ntohl(ra_hdr->reachable_time) > 0) {
reachable_time = ntohl(ra_hdr->reachable_time);
}

-- Line 441-447: --
struct mtu_option * mtu_opt;
mtu_opt = (struct mtu_option *)buffer;
if (mtu_opt->mtu >= 1280) {
#if LWIP_ND6_ALLOW_RA_UPDATES
inp->mtu = mtu_opt->mtu;
#endif /* LWIP_ND6_ALLOW_RA_UPDATES */
}
should be:
struct mtu_option * mtu_opt;
mtu_opt = (struct mtu_option *)buffer;
if (ntohl(mtu_opt->mtu) >= 1280) {
#if LWIP_ND6_ALLOW_RA_UPDATES
inp->mtu = ntohl(mtu_opt->mtu);
#endif /* LWIP_ND6_ALLOW_RA_UPDATES */
}

-- Line 468: --
prefix_list[i].invalidation_timer = prefix_opt->valid_lifetime;
should be:
prefix_list[i].invalidation_timer = ntohl(prefix_opt->valid_lifetime);

-- Line 597: --
destination_cache[i].pmtu = icmp6hdr->data;
should be
destination_cache[i].pmtu = ntohl(icmp6hdr->data);

Zach Smith <zsmith>

 

Attached Files
file #32624:  nd6_byte_order_issues.patch added by zsmith (2KiB - application/octet-stream - added patch file)
file #27318:  nd6.c added by zsmith (59KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by zsmith (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 04 Mar 2015 07:49:37 PM UTCgoldsimonStatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed
    Tue 09 Dec 2014 12:28:05 AM UTCzsmithAttached File-=>Added nd6_byte_order_issues.patch, #32624
    Fri 28 Jun 2013 07:55:24 PM UTCgoldsimonPlanned Release=>1.5.0 beta1
    Wed 23 Jan 2013 08:13:24 PM UTCzsmithAttached File-=>Added nd6.c, #27318

    Back to the top


    Powered by Savane 3.1-cleanup1