[lwip-devel] [bug #49328] Crash error in ip6_frag due to Assertion Fail

[Arpit Agarwal]

URL:
  <http://savannah.nongnu.org/bugs/?49328>

                 Summary: Crash error in ip6_frag due to Assertion Fail
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: arpit_iitg
            Submitted on: Thu 13 Oct 2016 04:39:39 AM GMT
                Category: IPv6
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: git head

    _______________________________________________________

Details:

There is a crash error observed in ip6_frag API due to following Assert fail:

rambuf = pbuf_alloc(PBUF_LINK, IP6_HLEN + IP6_FRAG_HLEN, PBUF_RAM);
    if (rambuf == NULL) {
      IP6_FRAG_STATS_INC(ip6_frag.memerr);
      return ERR_MEM;
    }
    LWIP_ASSERT("this needs a pbuf in one piece!",
                (p->len >= (IP6_HLEN + IP6_FRAG_HLEN)));

The scenario occurs when I try to use raw_sendto to send a ping6 packet.

I think the check in assertion is wrong. We should check rambuf->len and not
p->len as in the raw_sendto scenario p->len will be just IP6 Header len.

I locally tried modifying the assert check, and that works properly.




    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?49328>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/