[lwip-devel] [bug #22692] TCP: Header length not checked to be > 20

[Jared Grubb]

URL:
  <http://savannah.nongnu.org/bugs/?22692>

                 Summary: TCP: Header length not checked to be > 20
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: jgrubb
            Submitted on: Saturday 03/22/2008 at 07:55
                Category: TCP
                Severity: 6 - Security
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 

    _______________________________________________________

Details:

hdrlen = TCPH_HDRLEN(tcphdr);
if(pbuf_header(p, -(hdrlen * 4))){
...
}

There should be a check to make sure that hdrlen >= 5 (ie 20 bytes). The code
currently checks whether the hdrlen given will overrun the whole packet, but
does not verify that the value is a valid TCP header length.




    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?22692>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/