[lwip-devel] [bug #51135] etharp_query might under-allocate when copying a volatile packet

[Tim Cussins]

URL:
  <http://savannah.nongnu.org/bugs/?51135>

                 Summary: etharp_query might under-allocate when copying a
volatile packet 
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: tcussins
            Submitted on: Mon 29 May 2017 02:24:43 PM UTC
                Category: IPv4
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: git head

    _______________________________________________________

Details:

Hi all,

If etharp_query() needs to queue a packet that involves volatile pbufs, it
allocates a new pbuf from RAM, and copies the outgoing packet into the new
pbuf, and enqueues the new pbuf in place of the outgoing packet.

The line that allocates the pbuf allocation uses a temporary struct pbuf* 'p',
instead of the outgoing packet pbuf, 'q'. This can result in the allocation of
a pbuf that is not large enough to allow the copy to take place :)

Attached patch has slightly fuller explanation & fix.

Thanks,
Tim



    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Mon 29 May 2017 02:24:43 PM UTC  Name:
0001-etharp.c-Ensure-etharp_query-allocates-adequate-pbuf.patch  Size: 2kB  
By: tcussins
Proposed patch.
<http://savannah.nongnu.org/bugs/download.php?file_id=40808>

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?51135>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/