lwIP - A Lightweight TCP/IP stack - Bugs: bug #41009, IPv6 reassembly broken on 64-bit...
You are not allowed to post comments on this tracker with your current authentication level.
bug #41009: IPv6 reassembly broken on 64-bit platforms
Submitter: | Valery Ushakov <uwe> | ||
Submitted: | Fri 27 Dec 2013 01:28:31 AM UTC | ||
Category: | IPv6 | Severity: | 3 - Normal |
Item Group: | Faulty Behaviour | Status: | Fixed |
Privacy: | Public | Assigned to: | goldsimon |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | git head |
Jump to the original submission
Fri 28 Aug 2015 12:37:26 PM UTC, comment #13: |
Simon Goldschmidt <goldsimon> |
Fri 28 Aug 2015 12:33:17 PM UTC, comment #12: Erm. Nevermind, just got fooled by a typo in the assert comment and syntax hilighting telling me the assert was still used. Anyway, typo fixed IP6_FRAG_COPYHEADER -> IPV6_FRAG_COPYHEADER. |
Sylvain Rochet <gradator> |
Thu 27 Aug 2015 09:37:24 PM UTC, comment #11: I failed to see how the assert works, IP6_FRAG_COPYHEADER does not change sizeof(struct ip6_reass_helper) nor IP6_FRAG_HLEN right ? So the assert is always triggered isn't it ?
|
Sylvain Rochet <gradator> |
Thu 27 Aug 2015 07:45:41 PM UTC, comment #10: Honestly, I don't want to fix this for windows and linux only. I've instead added a sanity check to ip6_reass_tmr(), so you don't actually need to receive a fragmented packet to trigger the assert. Any good compiler should optimize this check to nothing on 32-or-less-bit platforms. |
Simon Goldschmidt <goldsimon> |
Wed 26 Aug 2015 09:51:29 PM UTC, comment #9: #define IPV6_FRAG_COPYHEADER (defined(_LP64_) || defined(_WIN64))
|
Sylvain Rochet <gradator> |
Wed 26 Aug 2015 09:43:24 PM UTC, comment #8: Indeed, I failed to add that any usage of IP6_FRAG_COPYHEADER should be rewritten using if() { }.
|
Sylvain Rochet <gradator> |
Wed 26 Aug 2015 09:24:16 PM UTC, comment #7: Preprocessor doesn't do sizeof(). |
Valery Ushakov <uwe> |
Wed 26 Aug 2015 09:16:58 PM UTC, comment #6: What about adding the following in opt.h (instead of living in ip6_frag.h):
#ifndef IPV6_FRAG_COPYHEADER
|
Sylvain Rochet <gradator> |
Wed 26 Aug 2015 08:17:19 PM UTC, comment #5: Fixed with a minimal change:
|
Simon Goldschmidt <goldsimon> |
Tue 24 Mar 2015 07:06:52 PM UTC, comment #4: This still should be fixed for 1.5.0 |
Simon Goldschmidt <goldsimon> |
Fri 06 Mar 2015 09:16:50 PM UTC, comment #3: As the patch is only required for >32 bit machines and it's no a trivial one, I'm not applying this without thorough testing.
|
Simon Goldschmidt <goldsimon> |
Mon 17 Nov 2014 11:43:18 AM UTC, comment #2: Attached is rewritten reassembly code. The diff corresponds to tree state before 381a7b110a4a611e9956b2c644bc330bacb87073 ("fixed bug #41041 Potential use-after-free in IPv6 reassembly"), which is superceeded by this diff. Typos fixed by the two commits after that are also already fixed in this diff. |
Valery Ushakov <uwe> |
Fri 10 Jan 2014 09:09:51 PM UTC, comment #1: You're right. I've just added an assert should triggers this. However, I don't have an idea how to solve this right now. |
Simon Goldschmidt <goldsimon> |
Fri 27 Dec 2013 01:28:31 AM UTC, original submission:
struct ip6_reass_helper "replaces the Fragment Header in memory in
|
Valery Ushakov <uwe> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 7 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2015-08-26 | goldsimon | Status | Confirmed | Fixed | |
Assigned to | None | goldsimon | |||
Open/Closed | Open | Closed | |||
2015-03-24 | goldsimon | Planned Release | 1.5.0 | ||
2015-03-06 | goldsimon | Attached File | - | Added ip6_reass_007ab69777219848dc0d205ec9bb9594ec1eb60b.diff, #33272 | |
2014-11-17 | uwe | Attached File | - | Added ip6_reass.diff, #32451 | |
2014-01-10 | goldsimon | Status | None | Confirmed |
Powered by Savane 3.13-caa5.
Corresponding source code
Thanks :-)