[lwip-devel] LWIP igmp.c crashes with divison by zero

[Baudouin, Charles]

Sorry not sure who to send this to:

LWIP 1.4.1

IGMP crashes with division by zero when a IGMP packet is received with zero response time.

igmp.c

 

/**

* Start a timer for an igmp group

*

* @param group the igmp_group for which to start a timer

* @param max_time the time in multiples of IGMP_TMR_INTERVAL (decrease with

*        every call to igmp_tmr())

*/

static void

igmp_start_timer(struct igmp_group *group, u8_t max_time)

{

  /* ensure the input value is > 0 */

  if (max_time == 0) {

    max_time = 1;

  }

  /* ensure the random value is > 0 */

  group->timer = (LWIP_RAND() % (max_time - 1)) + 1;

}

 

If called with max_time = 0 or 1.

Should read:

 

static void

igmp_start_timer(struct igmp_group *group, u8_t max_time)

{

  /* ensure the input value is > 0 */

  if (max_time < 2) {

    max_time = 2;

  }

  /* ensure the random value is > 0 */

  group->timer = (LWIP_RAND() % (max_time - 1)) + 1;

}

 

This E-mail and any files transmitted with it ("E-mail") is intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the addressee(s), any disclosure, reproduction, copying, distribution or other use of the E-mail is prohibited. If you have received this E-mail in error, please delete it and notify the sender immediately via our switchboard or return e-mail.
 
Neither the company nor any subsidiary or affiliate or associated company nor any individual sending this E-mail accepts any liability in respect of the content (including errors and omissions) nor shall this e-mail be deemed to enter the company or any subsidiary or affiliate or associated company into a contract or to create any legally binding obligations unless expressly agreed to in writing under separate cover and timeliness of the E-mail which arise as a result of transmission. If verification is required, please request a hard copy version from the sender.