lwIP - A Lightweight TCP/IP stack - Bugs: bug #41041, Potential use-after-free in IPv6...
You are not allowed to post comments on this tracker with your current authentication level.
bug #41041: Potential use-after-free in IPv6 reassembly
Submitter: | Valery Ushakov <uwe> | ||
Submitted: | Tue 31 Dec 2013 02:00:17 AM UTC | ||
Category: | IPv6 | Severity: | 3 - Normal |
Item Group: | Faulty Behaviour | Status: | Fixed |
Privacy: | Public | Assigned to: | goldsimon |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | git head |
Mon 19 May 2014 08:04:12 PM UTC, comment #5: |
Simon Goldschmidt <goldsimon> |
Mon 17 Feb 2014 12:48:44 AM UTC, comment #4: Both IPv6 and IPv4 fixes have a fatal typo in the third expression of the for loop:
|
Valery Ushakov <uwe> |
Fri 10 Jan 2014 08:48:05 PM UTC, comment #3: Fixed, thanks for reporting. |
Simon Goldschmidt <goldsimon> |
Fri 10 Jan 2014 08:45:09 PM UTC, comment #2: Since IPv6 reassembly was copied from IPv4 reassembly, this partly applies to ip_reass(), too. |
Simon Goldschmidt <goldsimon> |
Tue 31 Dec 2013 02:19:29 AM UTC, comment #1: Another use-after-free in ip6_reass() is the code to "Move pbuf back
|
Valery Ushakov <uwe> |
Tue 31 Dec 2013 02:00:17 AM UTC, original submission:
From source code inspection, haven't tried to reproduce it since that
|
Valery Ushakov <uwe> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 3 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-01-10 | goldsimon | Status | None | Fixed | |
Assigned to | None | goldsimon | |||
Open/Closed | Open | Closed |
Powered by Savane 3.13-758e.
Corresponding source code
Right. Thanks for reporting. I haven't seen this, though, and it slipped through since the bug was already closed :-(