buglwIP - A Lightweight TCP/IP stack - Bugs: bug #54805, IP address can not be obtained...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #54805: IP address can not be obtained over dhcp if PBUF_POOL_BUFSIZE is too small

Submitter:  Christoph Chang <christophchang>
Submitted:  Mon 08 Oct 2018 02:08:42 PM UTC
   
 
Category:  DHCP Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  2.0.3

Sun 03 Oct 2021 10:36:20 AM UTC, comment #3: 

Thanks, I added it: d876d3c4df3508c19

Erik Ekman <yarrick>
Group Member
Sun 03 Oct 2021 01:09:55 AM UTC, comment #2: 

This one seems material for v2.1.3.
(commit 64bc2c3df7b3 Fix bug #54805: IP address can not be obtained over dhcp if PBUF_POOL_BUFSIZE is too small)
Need to fix conflict by changing LWIP_ERROR to LWIP_DHCP_INPUT_ERROR for v2.1.3.

Axel Lin <axellin>
Group Member
Fri 19 Oct 2018 07:16:45 PM UTC, comment #1: 

Applied your patch, thanks for reporting!

Dirk Ziegelmeier <dziegel>
Group administrator
Mon 08 Oct 2018 02:08:42 PM UTC, original submission:  

Hi,
if the PBUF_POOL_BUFSIZE (project specific) is set to a smaller size than the minimum dhcp message size and a dhcp message is received with an DHCP_OPTION_OVERLOAD flag, that is correctly set in the options field (but not set in the file or sname field), a valid IP address cannot be obtained.

Instead I get the assertion text:
"overload in file/sname" failed at line 1561 ..."
(in \src\core\ipv4\dhcp.c using lwip 2.0.3)
which should prevent an endless loop, in case the DHCP_OPTION_OVERLOAD is set
in the file or sname field:

  • dhcp.c: fixed bug #49676 (Possible endless loop when parsing dhcp options)


If PBUF_POOL_BUFSIZE is smaller than a dhcp message or at least the DHCP_OPTIONS_OFS, in

1491  while ((q != NULL) && (options_idx >= q->len)) {
1492    options_idx -= q->len;
1493    options_idx_max -= q->len;
1494    q = q->next;
1495  }

the options_idx will be corrected to match the offset in the pbuf containing the option field. In this case
1561  LWIP_ERROR("overload in file/sname", options_idx == DHCP_OPTIONS_OFS, return ERR_VAL;);
will always fail, since DHCP_OPTIONS_OFS will never match the relative options_idx.

(For a possible bugfix see attachment)

Best regards
Christoph

Christoph Chang <christophchang>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #45164:  dhcp.c.diff added by christophchang (1KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yarrick (Posted a comment)
  • -email is unavailable- added by axellin (Posted a comment)
  • -email is unavailable- added by dziegel (Posted a comment)
  • -email is unavailable- added by christophchang (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-10-19 dziegel StatusNone Fixed
        Open/ClosedOpen Closed
    2018-10-08 christophchang Attached File- Added dhcp.c.diff, #45164

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code