[lwip-devel] [bug #39514] ip_route() may return an IPv6-only interface that will crash calling netif->output()

[Christian Sasso]

URL:
  <http://savannah.nongnu.org/bugs/?39514>

                 Summary: ip_route() may return an IPv6-only interface that
will crash calling netif->output()
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: chris73it
            Submitted on: Thu 18 Jul 2013 04:47:46 AM GMT
                Category: IPv4
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 
            lwIP version: git head

    _______________________________________________________

Details:

When netif_list contains at least an IPv6-only interface that is up, the
ip_route() function may return such interface since its netmask is 0, and the
condition inside the for-loop:
  (ip_addr_netcmp(dest, &(netif->ip_addr), &(netif->netmask)))
is always true, irrespective of the value of dest.
Eventually LwIP crashes attempting to call netif->output() on the interface
returned by ip_route().

This patch works for me:
diff --git a/src/core/ipv4/ip4.c b/src/core/ipv4/ip4.c
index 4b38999..decf8c4 100644
--- a/src/core/ipv4/ip4.c
+++ b/src/core/ipv4/ip4.c
@@ -123,7 +123,11 @@ ip_route(ip_addr_t *dest)
   /* iterate through netifs */
   for (netif = netif_list; netif != NULL; netif = netif->next) {
     /* network mask matches? */
-    if (netif_is_up(netif)) {
+    if ((netif_is_up(netif))
+#if LWIP_IPV6
+      && (!ip_addr_isany(&(netif->ip_addr)))
+#endif /* LWIP_IPV6 */
+    ) {
       if (ip_addr_netcmp(dest, &(netif->ip_addr), &(netif->netmask))) {
         /* return netif on which to forward IP packet */
         return netif;




    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?39514>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/