[lwip-devel] [bug #37853] Incoming packet with invalid ip header length causes assertion

[Martin Sträng]

URL:
  <http://savannah.nongnu.org/bugs/?37853>

                 Summary: Incoming packet with invalid ip header length causes
assertion
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: mstrang
            Submitted on: mån  3 dec 2012 09.39.36
                Category: IPv4
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Private
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 
            lwIP version: 1.4.0

    _______________________________________________________

Details:

If an IP packet with an erroneous header length is sent to a DUT running lwip,
this invalid header is caught by a LWIP_ERROR-check in the pbuf_header which
in the default implementation leads to a platform_assert.

In this case the value of header length in the IP header is larger than the
value of the total IP length.

In function ip_input, after pbuf_realloc has been called on line 375, there is
a possibility that iphdh_hlen > pbuf->len. (This probably only occur if
purposly erroneous packets are sent to the DUT).

My suggestion is to add another check on the header length according to the
supplied patch in order to throw away this type of bad packets without getting
caught in an assertion.

Maybe also add a check that: iphdr_hlen < IP_HLEN (Im not sure if this is
already covered somewhere).



    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: mån  3 dec 2012 09.39.36  Name: ip4.patch  Size: 1 kB   By: mstrang

<http://savannah.nongnu.org/bugs/download.php?file_id=27027>

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?37853>

_______________________________________________
  Meddelandet skickades via/av Savannah
  http://savannah.nongnu.org/