lwIP - A Lightweight TCP/IP stack - Bugs: bug #59468, null pointer dereference of lwip...
You are not allowed to post comments on this tracker with your current authentication level.
bug #59468: null pointer dereference of lwip function ip_reass_free_complete_datagram
Submitter: | Wenqiang Li <silentdawn> | ||
Submitted: | Tue 17 Nov 2020 12:47:52 AM UTC | ||
Votes: | 100 | ||
Category: | Security-related | Severity: | 3 - Normal |
Item Group: | Crash Error | Status: | None |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Open | Planned Release: | None |
lwIP version: | git head |
Mon 27 Sep 2021 05:41:04 AM UTC, comment #2: |
Prateek Tathicherla <ptath1> |
Sat 03 Apr 2021 12:31:06 PM UTC, comment #1: The attached test file is just a bunch of raw Ethernet packets concatenated together (no pcap format). Can you upload a fixed version? |
Erik Ekman <yarrick>![]() |
Tue 17 Nov 2020 12:47:52 AM UTC, original submission:
The lwip function ip_reass_free_complete_datagram() is used to free a datagram (struct ip_reassdata) and all its pbufs. It's called by the function ip_reass_tmr() timely or the function ip_reass_remove_oldest_datagram() to clear oldest datagram.
|
Wenqiang Li <silentdawn> |
Depends on the following items: None found
Items that depend on this one: None found
There are 100 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 4 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2021-09-27 | ptath1 | Attached File | - | ![]() |
Added test_ping.pcap, #51976 |
2021-09-27 | ptath1 | Carbon-Copy | - | ![]() |
Added ptath1 |
2020-11-17 | silentdawn | Attached File | - | ![]() |
Added testcase0.txt, #50288 |
Carbon-Copy | - | ![]() |
Added -email is unavailable- |
I get a similar error on line 199 where p != NULL but p->payload = NULL. I can replicate this with a large ping: ping -s 5000 and then wait for the ip_reass_remove_oldest_datagram() to get called.
Doesn't look like ipr contains the full datagram either. In my case, this only happens for >3 fragments.