buglwIP - A Lightweight TCP/IP stack - Bugs: bug #57375, Assertion "mss_local is too...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57375: Assertion "mss_local is too small" failed

Submitter:  Hiromasa Ito <vhertz>
Submitted:  Sat 07 Dec 2019 01:13:38 PM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  Other

Mon 29 Jun 2020 08:00:10 PM UTC, comment #1: 

I can reproduce this with the latest code by simulating the old rand implementation:

$ cd test/fuzz
$ make all D="-DLWIP_RAND_FOR_FUZZ_SIMULATE_GLIBC"
$ ./lwip_fuzz3 crashed_inputs/004
reading input from file... testing file: "crashed_inputs/004"...
Assertion "mss_local is too small" failed at line 486 in ../../src/core/tcp_out.c
Aborted (core dumped)


The relevant code was changed in fixing bug #25882, bug #36153 and bug #37184, so any fix must be carefully designed.

Erik Ekman <yarrick>
Group Member
Sat 07 Dec 2019 01:13:38 PM UTC, original submission:  

Hi, all.

This is one of the assertion failures I found by fuzzing (to lwIP ver2.1.0.RC1).
The following LWIP_ASSERT() at lwip/src/core/tcp_out.c:486 fails.


LWIP_ASSERT("mss_local is too small", mss_local >= last_unsent->len + unsent_optlen);


As described in the assertion, too small MSS causes this failure.
Incomming packets can set MSS in the range of 0 < MSS < TCP_MSS.
At tcp_in.c:1943, pcb->mss is set as below without any other validation:


pcb->mss = ((mss > TCP_MSS) || (mss == 0)) ? TCP_MSS : mss;


You can reproduce this failure with 'crashed_inputs/004' attached to the following message of lwip-devel:
https://lists.nongnu.org/archive/html/lwip-devel/2019-12/msg00013.html

 Hiromasa Ito <vhertz>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yarrick (Posted a comment)
  • -email is unavailable- added by vhertz (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Copyright © 2025 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-04e1.
    Corresponding source code