buglwIP - A Lightweight TCP/IP stack - Bugs: bug #57526, Fix the dns entries pcb_idx range

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57526: Fix the dns entries pcb_idx range

Submitter:  Konstantin <tomcat_84>
Submitted:  Fri 03 Jan 2020 11:44:52 AM UTC
   
 
Category:  DNS Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Invalid
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  2.1.1

Sat 11 Jan 2020 08:34:55 AM UTC, comment #2: 

Silly me, mixed up the versions.

The behavior was observed in test project, but the version used there was 2.0.0.RC1. :)

A line "entry->state = DNS_STATE_DONE" was missing there, which caused dns_check_entry() to call dns_send() with illegal entry->pcb_idx. This was already fixed in 2.0.0.RC2 .

Sorry for inconvenience.

Best regards,

Konstantin <tomcat_84>
Thu 09 Jan 2020 08:09:02 PM UTC, comment #1: 

I take it this is from reading the code only. Let me explain:
- dns_send() is called for DNS_STATE_NEW and DNS_STATE_ASKING only
- pcb_idx is set to DNS_MAX_SOURCE_PORTS only when the table entry is set to DNS_STATE_UNUSED

Being like that, this cannot happen. I'll add an assert anyway, but no, it currently cannot cause table reading out of range.

Simon Goldschmidt <goldsimon>
Group administrator
Fri 03 Jan 2020 11:44:52 AM UTC, original submission:  

in dns_send(), when

#if ((LWIP_DNS_SECURE & LWIP_DNS_SECURE_RAND_SRC_PORT) != 0)

condition is met, pcb_idx is taken from the dns_table entry.

This pcb_idx probably can be equal to DNS_TABLE_SIZE, being set so elsewhere. It is not tested inside dns_send(). It can cause table reading out of range.

Konstantin <tomcat_84>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by tomcat_84 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-01-09 goldsimon StatusNone Invalid
        Assigned toNone goldsimon
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code