[En-Nut-Discussion] FYI: Bug in ICMP destination unreachable handling fixed

[Ole Reinhardt]

Hi,

sure, but it is just applied.

Best regards,

Ole Reinhardt


Index: nut/net/icmpin.c
===================================================================
--- nut/net/icmpin.c	(Revision 6134)
+++ nut/net/icmpin.c	(Revision 6135)
@@ -117,7 +117,7 @@
             TCPHDR *th;
             TCPSOCKET *sock_tcp;

-            th = (TCPHDR *) ((char *) ih) + sizeof(IPHDR);
+            th = (TCPHDR *) (((char *) ih) + sizeof(IPHDR));
             sock_tcp = NutTcpFindSocket(th->th_dport, th->th_sport,
ih->ip_src);
             if (sock_tcp == 0)
                 return -1;






Am 28.09.2015 16:08, schrieb Coleman Brumley:
> Ole,
> 
> Can you please post the patch here as well?
> 
> Coleman
> 
>> -----Original Message-----
>> From: en-nut-discussion-bounces at egnite.de [mailto:en-nut-discussion-
>> bounces at egnite.de] On Behalf Of Ole Reinhardt
>> Sent: Monday, September 28, 2015 7:57 AM
>> To: Ethernut User Chat (English) <en-nut-discussion at egnite.de>
>> Subject: [En-Nut-Discussion] FYI: Bug in ICMP destination unreachable
>> handling fixed
>>
>> Hi all,
>>
>> in SVN trunk r6135 I fix a bug in the handling of ICMP code 3 messages
>> (destination unreachable). It was caused by missing parenthesis in pointer
>> arithmetic.
>>
>> As result, NutTcpFindSocket() (in NutIcmpUnreach()) was fed with invalid
>> data. In worst case this could have led to sockets beeing abborting
> accidently,
>> in most cases nothing happened at all, as no matching socket could be
> found.
>>
>> But even worse, this bug also could result in crashes, if the pointer
> arithmetic
>> resulted in a read out of the physical memory bounds.
>>
>> It might be a good idea to update Nut/OS in your projects which rely on a
>> correct ICMP handling.
>>
>> Best regards,
>>
>> Ole
>>
>> --
>> kernel concepts GmbH            Tel: +49-271-771091-14
>> Sieghuetter Hauptweg 48         Mob: +49-177-7420433
>> D-57072 Siegen
>> http://www.embedded-it.de
>> http://www.kernelconcepts.de
>> _______________________________________________
>> http://lists.egnite.de/mailman/listinfo/en-nut-discussion
> 
> _______________________________________________
> http://lists.egnite.de/mailman/listinfo/en-nut-discussion
> 

-- 
kernel concepts GmbH            Tel: +49-271-771091-14
Sieghuetter Hauptweg 48         Mob: +49-177-7420433
D-57072 Siegen
http://www.embedded-it.de
http://www.kernelconcepts.de