patchlwIP - A Lightweight TCP/IP stack - Patches: patch #10179, PPPoS: Fix null-deref when...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #10179: PPPoS: Fix null-deref when processing double break packet

Submitter:  David Cermak <david_cermak>
Submitted:  Fri 18 Feb 2022 05:33:48 PM UTC
 
Category:  PPP Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Planned Release:  None

Fri 18 Feb 2022 05:33:48 PM UTC, original submission:  

Hi,

When processing an input packet containing only zero's, the pppos state machine assumes these are control fields, so doesn't allocate any pbuf for data. So if the `PPP_FLAG` comes (start of another valid packet) in this state and the `FCS` is valid (which is valid as long as only zero characters are being received) we de-reference `pppos->in_tail` in pppos.c:544.

This is happening (~ frequently) on some devices which send break signal during reconnection (see https://github.com/espressif/esp-idf/issues/8300)

This issue was reported some time ago as https://github.com/espressif/esp-lwip/pull/24
(but didn't any conclusive evidence the issue is in lwip)

I'm attaching the original patch by @peter-pycom

Also, adding a unit test that exhibits this issue as a separate patch.

David Cermak <david_cermak>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #53049:  PPP-Add-test-exhibiting-empty-packet-null-deref_REV1.patch added by david_cermak (6KiB - text/x-patch - Correction on the test commit: clang fails to compile PPP test suite due to a dead code if PPP_AUTH==0)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by david_cermak (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

     

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-04-05 david_cermak Attached File- Added PPP-Add-test-exhibiting-empty-packet-null-deref_REV1.patch, #53049
    2022-02-18 david_cermak Attached File- Added pppos-fix-in_tail-null.patch, #52881
        Attached File- Added PPP-Add-test-exhibiting-empty-packet-null-deref.patch, #52882

    Back to the top


    Powered by Savane 3.9