buglwIP - A Lightweight TCP/IP stack - Bugs: bug #59603, Use-after-free if...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #59603: Use-after-free if tcp_process_refused_data() returns ERR_ABRT

Submitted by:  Tom Vajzovic <tcv>
Submitted on:  Wed 02 Dec 2020 08:37:24 PM UTC  
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  2.1.1

Wed 02 Dec 2020 08:37:24 PM UTC, original submission:  

Hi,

I think I've found a use-after-free in tcp_input().

If tcp_process_refused_data() returns ERR_ABRT, then tcp_input() continues to use the pcb (accessing pcb->refused_data, pcb->rcv_ann_wnd and calling tcp_send_empty_ack()).

I think it needs to goto aborted directly.

I'm not sure if there might also be a memory leak: does tcv_input() need to call tcp_abort() itself if the receive callback didn't return ERR_ABRT but ((pcb->refused_data != NULL) && (tcplen > 0)) is true?  If not then maybe it shouln't goto aborted in that case.

Thanks,
Tom

Tom Vajzovic <tcv>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by tcv (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.7