buglwIP - A Lightweight TCP/IP stack - Bugs: bug #57481, Lease timeout timers overflow

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57481: Lease timeout timers overflow

Submitter:  S. Janek <sjanek>
Submitted:  Thu 26 Dec 2019 03:17:50 AM UTC
   
 
Category:  DHCP Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Invalid
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Fri 03 Jan 2020 08:31:45 AM UTC, comment #1: 

I think your analysis is wrong: those timeout values are in DHCP_COARSE_TIMER_SECS, which is one minute, so you have to divide your overflow calculation by 60. So the maximum value for those timers will be ~45 days.

Also, the value is not just assigned. It is checked for overflow and limited to 0xffff instead of overflowing.

In the old days where people actually cared for every byte, we decided that 45 days should be more than enough and it should be ok to trim here.

Simon Goldschmidt <goldsimon>
Group administrator
Thu 26 Dec 2019 03:17:50 AM UTC, original submission:  

Hi,

I am not sure if its bug but:
in function called dhcp_bind there is assignation of timeouts to variables (defined in struct dhcp):
t0_timeout
t1_timeout
t2_timeout
which are 16 bits, form variable timeout of size 32 bits.


For lease time one day the timeout is 86400 this value is out of range 16 bits variable. I have timeouts received from router as follow:
t0=86400
t1=43200
t2=75600
this cause variable overflow and results that condition:
  /* If we have sub 1 minute lease, t2 and t1 will kick in at the same time. */
  if ((dhcp->t1_timeout >= dhcp->t2_timeout) && (dhcp->t2_timeout > 0)) {
    dhcp->t1_timeout = 0;
  }
is true.

Is a bug?

S. Janek <sjanek>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by sjanek (Submitted the item)
  • -email is unavailable- added by sjanek
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-01-03 goldsimon StatusNone Invalid
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2019-12-26 sjanek Carbon-Copy- Added sjanek

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code