patchlwIP - A Lightweight TCP/IP stack - Patches: patch #10124, bug: LWIP_DHCP_MAX_DNS_SERVERS...


You are not allowed to post comments on this tracker with your current authentication level.

patch #10124: bug: LWIP_DHCP_MAX_DNS_SERVERS < DNS_MAX_SERVERS is causing memory corruption

Submitter:  Borys Szefler <bsz>
Submitted:  Tue 19 Oct 2021 08:33:42 AM UTC
Category:  DHCP Priority:  7 - High
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Planned Release:  None

Tue 19 Oct 2021 08:33:42 AM UTC, original submission:  

Bug reproduction:


Bug cause:
 In above case DHCP_OPTION_IDX_MAX = 9, so dhcp_rx_options_val and   dhcp_rx_options_given tables have size = 9.

 Then in dhcp_parse_reply function(dhcp.c file) we have
decode_len = LWIP_MIN(len, 4 * DNS_MAX_SERVERS); which next is causing incrementing decode_idx to 9 and reading/writing above tables with idx = 9 which is causing memory corruption.

 decode_len = LWIP_MIN(len, 4 * DNS_MAX_SERVERS); resolves this problem

Borys Szefler <bsz>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by bsz (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.




    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-10-19 bsz Attached File- Added dhcp_max_servers_memory_corruption_fix.patch, #52123

    Back to the top

    Powered by Savane 3.9