mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-12-25 00:14:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

ip4_frag: don't use LWIP_ERROR where we might depend in input data

Browse Source 
fuzz test revealed that an ip header with options might land in ip4_frag() via ICMP. In this case, we can't use LWIP_ERROR() to check for not having ip options as that might be defined to assert
This commit is contained in:
goldsimon 2018-01-09 10:24:26 +01:00
parent deab51c36d
commit 2d06483d8e
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/core/ipv4/ip4_frag.c
View File

@ -748,7 +748,10 @@ ip4_frag(struct pbuf *p, struct netif *netif, const ip4_addr_t *dest)
original_iphdr = (struct ip_hdr *)p->payload; original_iphdr = (struct ip_hdr *)p->payload;
iphdr = original_iphdr; iphdr = original_iphdr;
LWIP_ERROR("ip4_frag() does not support IP options", IPH_HL_BYTES(iphdr) == IP_HLEN, return ERR_VAL); if (IPH_HL_BYTES(iphdr) != IP_HLEN) {
/* ip4_frag() does not support IP options */
return ERR_VAL;
}
LWIP_ERROR("ip4_frag(): pbuf too short", p->len >= IP_HLEN, return ERR_VAL); LWIP_ERROR("ip4_frag(): pbuf too short", p->len >= IP_HLEN, return ERR_VAL);
/* Save original offset */ /* Save original offset */