[lwip-devel] [bug #51596] ip4_reass: Insufficient overlap check

[Ambroz Bizjak]

URL:
  <http://savannah.nongnu.org/bugs/?51596>

                 Summary: ip4_reass: Insufficient overlap check
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: abizjak
            Submitted on: Thu 27 Jul 2017 10:55:33 PM UTC
                Category: IPv4
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: git head

    _______________________________________________________

Details:

http://git.savannah.gnu.org/cgit/lwip.git/tree/src/core/ipv4/ip4_frag.c?id=925f3944d3d9de6e730f6d0738844f339ce9e35c#n383

(iprh->end > iprh_tmp->start) should be checked regardless of whether
iprh_prev is NULL, otherwise it may end up inserting the pbuf in the head of
the chain which overlaps with the next one.




    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?51596>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/