patchlwIP - A Lightweight TCP/IP stack - Patches: patch #10179, PPPoS: Fix null-deref when...


You are not allowed to post comments on this tracker with your current authentication level.

patch #10179: PPPoS: Fix null-deref when processing double break packet

Submitter:  David Cermak <david_cermak>
Submitted:  Fri 18 Feb 2022 05:33:48 PM UTC
Category:  PPP Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Planned Release:  None

Fri 18 Feb 2022 05:33:48 PM UTC, original submission:  


When processing an input packet containing only zero's, the pppos state machine assumes these are control fields, so doesn't allocate any pbuf for data. So if the `PPP_FLAG` comes (start of another valid packet) in this state and the `FCS` is valid (which is valid as long as only zero characters are being received) we de-reference `pppos->in_tail` in pppos.c:544.

This is happening (~ frequently) on some devices which send break signal during reconnection (see

This issue was reported some time ago as
(but didn't any conclusive evidence the issue is in lwip)

I'm attaching the original patch by @peter-pycom

Also, adding a unit test that exhibits this issue as a separate patch.

David Cermak <david_cermak>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #53049:  PPP-Add-test-exhibiting-empty-packet-null-deref_REV1.patch added by david_cermak (6KiB - text/x-patch - Correction on the test commit: clang fails to compile PPP test suite due to a dead code if PPP_AUTH==0)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by david_cermak (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.




    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-04-05 david_cermak Attached File- Added PPP-Add-test-exhibiting-empty-packet-null-deref_REV1.patch, #53049
    2022-02-18 david_cermak Attached File- Added pppos-fix-in_tail-null.patch, #52881
        Attached File- Added PPP-Add-test-exhibiting-empty-packet-null-deref.patch, #52882

    Back to the top

    Powered by Savane 3.9