buglwIP - A Lightweight TCP/IP stack - Bugs: bug #57379, Assertion "Can't split...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57379: Assertion "Can't split segment into length 0" failed

Submitter:  Hiromasa Ito <vhertz>
Submitted:  Sat 07 Dec 2019 01:21:24 PM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  Other

Sat 07 Dec 2019 01:21:24 PM UTC, original submission:  

Hi, all.

This is one of the assertion failures I found by fuzzing (to lwIP ver2.1.0.RC1).
The following LWIP_ASSERT() at lwip/src/core/tcp_out.c:851 fails.


if (split == 0) {
  LWIP_ASSERT("Can't split segment into length 0", 0);
  return ERR_VAL;
}


This code is written in tcp_split_unsent_seg(),
and that is called from tcp_slowtmr() as below:


if (tcp_split_unsent_seg(pcb, (u16_t)pcb->snd_wnd) == ERR_OK) {


The 2nd argument of tcp_split_unsent_seg() is `split`.
If LWIP_WND_SCALE is defined, `pcb->snd_wnd` has 32-bit value.
If the lower 16bit of it is 0x0000, the value of `split` becomes 0x0000.
For example, if the value of `pcb->snd_wnd` is 0xffff0000, that of `split` is 0x0000.

As a result, the assertion fails.

You can reproduce this failure with 'crashed_inputs/008', attached to the following message of lwip-devel:
https://lists.nongnu.org/archive/html/lwip-devel/2019-12/msg00013.html

Hiromasa Ito <vhertz>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by vhertz (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-ec27.
    Corresponding source code