Tue 26 Aug 2014 05:06:11 PM UTC, original submission:
The crash error for the active LWIP_NETBUF_RECVINFO option in api_msg.c (lwip-1.4.1).
Last time, I worked with the lwIP stack and I have found a critical bug when the LWIP_NETBUF_RECVINFO option is active.
In the module “api_msg.c”, line number 184 we have:
const struct udp_hdr* udphdr = (void)(((char)iphdr) + IPH_LEN(iphdr));
The problem is that, the macro "IPH_LEN()" is without the Big/Little Endian control. For the Big Endian processor architecture it doesn’t pose a threat. For the Little Endian architecture, it causes that "IPH_LEN(iphdr)" generates incorrect value with bytes swapped inside the variable. With this wrong data, the pointer "udp_hdr * udphdr" has incorrect address.
I line 189 of the same module, we have:
buf->toport_chksum = udphdr->dest;
This statement causes that the program tries to fetch data from a random memory address, what in worst case – when we refer to a forbidden part of memory space – can cause a program crash.
In order to fix this bug, the line 184 has to be modified, like below:
const struct udp_hdr* udphdr = (void)(((char)iphdr) + ntohs(IPH_LEN(iphdr)));
Best regards,
Przemyslaw Bejtan.
|