mirror of
https://github.com/lwip-tcpip/lwip.git
synced 2024-10-02 12:52:10 +00:00
fixed bug #41041 Potential use-after-free in IPv6 reassembly
This commit is contained in:
parent
75f2c56558
commit
381a7b110a
@ -80,6 +80,9 @@ HISTORY
|
|||||||
|
|
||||||
++ Bugfixes:
|
++ Bugfixes:
|
||||||
|
|
||||||
|
2014-01-10: Simon Goldschmidt
|
||||||
|
* ip_frag.c, ip6_frag.c: fixed bug #41041 Potential use-after-free in IPv6 reassembly
|
||||||
|
|
||||||
2014-01-10: Simon Goldschmidt
|
2014-01-10: Simon Goldschmidt
|
||||||
* memp.c: fixed bug #41188 Alignment error in memp_init() when MEMP_SEPARATE_POOLS==1
|
* memp.c: fixed bug #41188 Alignment error in memp_init() when MEMP_SEPARATE_POOLS==1
|
||||||
|
|
||||||
|
@ -481,7 +481,6 @@ ip_reass(struct pbuf *p)
|
|||||||
struct ip_reass_helper *iprh;
|
struct ip_reass_helper *iprh;
|
||||||
u16_t offset, len;
|
u16_t offset, len;
|
||||||
u8_t clen;
|
u8_t clen;
|
||||||
struct ip_reassdata *ipr_prev = NULL;
|
|
||||||
|
|
||||||
IPFRAG_STATS_INC(ip_frag.recv);
|
IPFRAG_STATS_INC(ip_frag.recv);
|
||||||
snmp_inc_ipreasmreqds();
|
snmp_inc_ipreasmreqds();
|
||||||
@ -527,7 +526,6 @@ ip_reass(struct pbuf *p)
|
|||||||
IPFRAG_STATS_INC(ip_frag.cachehit);
|
IPFRAG_STATS_INC(ip_frag.cachehit);
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
ipr_prev = ipr;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if (ipr == NULL) {
|
if (ipr == NULL) {
|
||||||
@ -565,6 +563,7 @@ ip_reass(struct pbuf *p)
|
|||||||
/* find the right place to insert this pbuf */
|
/* find the right place to insert this pbuf */
|
||||||
/* @todo: trim pbufs if fragments are overlapping */
|
/* @todo: trim pbufs if fragments are overlapping */
|
||||||
if (ip_reass_chain_frag_into_datagram_and_validate(ipr, p)) {
|
if (ip_reass_chain_frag_into_datagram_and_validate(ipr, p)) {
|
||||||
|
struct ip_reassdata *ipr_prev;
|
||||||
/* the totally last fragment (flag more fragments = 0) was received at least
|
/* the totally last fragment (flag more fragments = 0) was received at least
|
||||||
* once AND all fragments are received */
|
* once AND all fragments are received */
|
||||||
ipr->datagram_len += IP_HLEN;
|
ipr->datagram_len += IP_HLEN;
|
||||||
@ -592,6 +591,14 @@ ip_reass(struct pbuf *p)
|
|||||||
pbuf_cat(p, r);
|
pbuf_cat(p, r);
|
||||||
r = iprh->next_pbuf;
|
r = iprh->next_pbuf;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* find the previous entry in the linked list */
|
||||||
|
for (ipr_prev = reassdatagrams; ipr_prev != NULL; ipr = ipr->next) {
|
||||||
|
if (ipr_prev->next == ipr) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
/* release the sources allocate for the fragment queue entry */
|
/* release the sources allocate for the fragment queue entry */
|
||||||
ip_reass_dequeue_datagram(ipr, ipr_prev);
|
ip_reass_dequeue_datagram(ipr, ipr_prev);
|
||||||
|
|
||||||
|
@ -290,7 +290,14 @@ ip6_reass(struct pbuf *p)
|
|||||||
/* Make room and try again. */
|
/* Make room and try again. */
|
||||||
ip6_reass_remove_oldest_datagram(ipr, clen);
|
ip6_reass_remove_oldest_datagram(ipr, clen);
|
||||||
ipr = (struct ip6_reassdata *)memp_malloc(MEMP_IP6_REASSDATA);
|
ipr = (struct ip6_reassdata *)memp_malloc(MEMP_IP6_REASSDATA);
|
||||||
if (ipr == NULL)
|
if (ipr != NULL) {
|
||||||
|
/* re-search ipr_prev since it might have been removed */
|
||||||
|
for (ipr_prev = reassdatagrams; ipr_prev != NULL; ipr = ipr->next) {
|
||||||
|
if (ipr_prev->next == ipr) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else
|
||||||
#endif /* IP_REASS_FREE_OLDEST */
|
#endif /* IP_REASS_FREE_OLDEST */
|
||||||
{
|
{
|
||||||
IP6_FRAG_STATS_INC(ip6_frag.memerr);
|
IP6_FRAG_STATS_INC(ip6_frag.memerr);
|
||||||
@ -322,7 +329,14 @@ ip6_reass(struct pbuf *p)
|
|||||||
if ((ip6_reass_pbufcount + clen) > IP_REASS_MAX_PBUFS) {
|
if ((ip6_reass_pbufcount + clen) > IP_REASS_MAX_PBUFS) {
|
||||||
#if IP_REASS_FREE_OLDEST
|
#if IP_REASS_FREE_OLDEST
|
||||||
ip6_reass_remove_oldest_datagram(ipr, clen);
|
ip6_reass_remove_oldest_datagram(ipr, clen);
|
||||||
if ((ip6_reass_pbufcount + clen) > IP_REASS_MAX_PBUFS)
|
if ((ip6_reass_pbufcount + clen) <= IP_REASS_MAX_PBUFS) {
|
||||||
|
/* re-search ipr_prev since it might have been removed */
|
||||||
|
for (ipr_prev = reassdatagrams; ipr_prev != NULL; ipr = ipr->next) {
|
||||||
|
if (ipr_prev->next == ipr) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else
|
||||||
#endif /* IP_REASS_FREE_OLDEST */
|
#endif /* IP_REASS_FREE_OLDEST */
|
||||||
{
|
{
|
||||||
/* @todo: send ICMPv6 time exceeded here? */
|
/* @todo: send ICMPv6 time exceeded here? */
|
||||||
@ -456,6 +470,7 @@ ip6_reass(struct pbuf *p)
|
|||||||
|
|
||||||
if (valid) {
|
if (valid) {
|
||||||
/* All fragments have been received */
|
/* All fragments have been received */
|
||||||
|
u8_t* iphdr_ptr;
|
||||||
|
|
||||||
/* chain together the pbufs contained within the ip6_reassdata list. */
|
/* chain together the pbufs contained within the ip6_reassdata list. */
|
||||||
iprh = (struct ip6_reass_helper*) ipr->p->payload;
|
iprh = (struct ip6_reass_helper*) ipr->p->payload;
|
||||||
@ -504,13 +519,14 @@ ip6_reass(struct pbuf *p)
|
|||||||
LWIP_ASSERT("sanity check linked list", ipr_prev != NULL);
|
LWIP_ASSERT("sanity check linked list", ipr_prev != NULL);
|
||||||
ipr_prev->next = ipr->next;
|
ipr_prev->next = ipr->next;
|
||||||
}
|
}
|
||||||
|
iphdr_ptr = (u8_t*)ipr->iphdr;
|
||||||
memp_free(MEMP_IP6_REASSDATA, ipr);
|
memp_free(MEMP_IP6_REASSDATA, ipr);
|
||||||
|
|
||||||
/* adjust the number of pbufs currently queued for reassembly. */
|
/* adjust the number of pbufs currently queued for reassembly. */
|
||||||
ip6_reass_pbufcount -= pbuf_clen(p);
|
ip6_reass_pbufcount -= pbuf_clen(p);
|
||||||
|
|
||||||
/* Move pbuf back to IPv6 header. */
|
/* Move pbuf back to IPv6 header. */
|
||||||
if (pbuf_header(p, (u8_t*)p->payload - (u8_t*)ipr->iphdr)) {
|
if (pbuf_header(p, (u8_t*)p->payload - iphdr_ptr)) {
|
||||||
LWIP_ASSERT("ip6_reass: moving p->payload to ip6 header failed\n", 0);
|
LWIP_ASSERT("ip6_reass: moving p->payload to ip6 header failed\n", 0);
|
||||||
pbuf_free(p);
|
pbuf_free(p);
|
||||||
return NULL;
|
return NULL;
|
||||||
|
Loading…
Reference in New Issue
Block a user