mirror of
https://github.com/lwip-tcpip/lwip.git
synced 2024-10-05 22:29:49 +00:00
Check for minimum IPv4 header length in rx packets
This commit is contained in:
parent
fda778f6b6
commit
61e067b98a
@ -89,6 +89,10 @@ icmp_input(struct pbuf *p, struct netif *inp)
|
|||||||
|
|
||||||
iphdr_in = ip4_current_header();
|
iphdr_in = ip4_current_header();
|
||||||
hlen = IPH_HL(iphdr_in) * 4;
|
hlen = IPH_HL(iphdr_in) * 4;
|
||||||
|
if (hlen < IP_HLEN) {
|
||||||
|
LWIP_DEBUGF(ICMP_DEBUG, ("icmp_input: short IP header (%"S16_F" bytes) received\n", hlen));
|
||||||
|
goto lenerr;
|
||||||
|
}
|
||||||
if (p->len < sizeof(u16_t)*2) {
|
if (p->len < sizeof(u16_t)*2) {
|
||||||
LWIP_DEBUGF(ICMP_DEBUG, ("icmp_input: short ICMP (%"U16_F" bytes) received\n", p->tot_len));
|
LWIP_DEBUGF(ICMP_DEBUG, ("icmp_input: short ICMP (%"U16_F" bytes) received\n", p->tot_len));
|
||||||
goto lenerr;
|
goto lenerr;
|
||||||
|
@ -410,7 +410,11 @@ ip4_input(struct pbuf *p, struct netif *inp)
|
|||||||
}
|
}
|
||||||
|
|
||||||
/* header length exceeds first pbuf length, or ip length exceeds total pbuf length? */
|
/* header length exceeds first pbuf length, or ip length exceeds total pbuf length? */
|
||||||
if ((iphdr_hlen > p->len) || (iphdr_len > p->tot_len)) {
|
if ((iphdr_hlen > p->len) || (iphdr_len > p->tot_len) || (iphdr_hlen < IP_HLEN)) {
|
||||||
|
if (iphdr_hlen < IP_HLEN) {
|
||||||
|
LWIP_DEBUGF(IP_DEBUG | LWIP_DBG_LEVEL_SERIOUS,
|
||||||
|
("ip4_input: short IP header (%"U16_F" bytes) received, IP packet dropped\n", iphdr_hlen));
|
||||||
|
}
|
||||||
if (iphdr_hlen > p->len) {
|
if (iphdr_hlen > p->len) {
|
||||||
LWIP_DEBUGF(IP_DEBUG | LWIP_DBG_LEVEL_SERIOUS,
|
LWIP_DEBUGF(IP_DEBUG | LWIP_DBG_LEVEL_SERIOUS,
|
||||||
("IP header (len %"U16_F") does not fit in first pbuf (len %"U16_F"), IP packet dropped.\n",
|
("IP header (len %"U16_F") does not fit in first pbuf (len %"U16_F"), IP packet dropped.\n",
|
||||||
|
Loading…
Reference in New Issue
Block a user