buglwIP - A Lightweight TCP/IP stack - Bugs: bug #59603, Use-after-free if...


You are not allowed to post comments on this tracker with your current authentication level.

bug #59603: Use-after-free if tcp_process_refused_data() returns ERR_ABRT

Submitted by:  Tom Vajzovic <tcv>
Submitted on:  Wed 02 Dec 2020 08:37:24 PM UTC
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  * 2.1.1
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:
       No canned response available


Wed 02 Dec 2020 08:37:24 PM UTC, original submission:  


I think I've found a use-after-free in tcp_input().

If tcp_process_refused_data() returns ERR_ABRT, then tcp_input() continues to use the pcb (accessing pcb->refused_data, pcb->rcv_ann_wnd and calling tcp_send_empty_ack()).

I think it needs to goto aborted directly.

I'm not sure if there might also be a memory leak: does tcv_input() need to call tcp_abort() itself if the receive callback didn't return ERR_ABRT but ((pcb->refused_data != NULL) && (tcplen > 0)) is true?  If not then maybe it shouln't goto aborted in that case.


Tom Vajzovic <tcv>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by tcv (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.





    No changes have been made to this item

    Back to the top

    Powered by Savane 3.9