patchlwIP - A Lightweight TCP/IP stack - Patches: patch #10124, bug: LWIP_DHCP_MAX_DNS_SERVERS...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #10124: bug: LWIP_DHCP_MAX_DNS_SERVERS < DNS_MAX_SERVERS is causing memory corruption

Submitter:  Borys Szefler <bsz>
Submitted:  Tue 19 Oct 2021 08:33:42 AM UTC
   
 
Category:  DHCP Priority:  7 - High
Status:  Done Privacy:  Public
Assigned to:  goldsimon Open/Closed:  Closed
Planned Release:  2.2.1

Thu 12 Oct 2023 08:08:47 PM UTC, comment #1: 

Pushed, thanks for the patch!

Simon Goldschmidt <goldsimon>
Group administrator
Tue 19 Oct 2021 08:33:42 AM UTC, original submission:  

Bug reproduction:

#define LWIP_DHCP_MAX_DNS_SERVERS 1
#define DNS_MAX_SERVERS 2

Bug cause:
 In above case DHCP_OPTION_IDX_MAX = 9, so dhcp_rx_options_val and   dhcp_rx_options_given tables have size = 9.

 Then in dhcp_parse_reply function(dhcp.c file) we have
decode_len = LWIP_MIN(len, 4 * DNS_MAX_SERVERS); which next is causing incrementing decode_idx to 9 and reading/writing above tables with idx = 9 which is causing memory corruption.

Using LWIP_DHCP_PROVIDE_DNS_SERVERS instead of DNS_MAX_SERVERS in
 decode_len = LWIP_MIN(len, 4 * DNS_MAX_SERVERS); resolves this problem

Borys Szefler <bsz>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by bsz (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-10-12 goldsimon StatusNone Done
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.2.1
    2021-10-19 bsz Attached File- Added dhcp_max_servers_memory_corruption_fix.patch, #52123

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code