[lwip-devel] [bug #57379] Assertion "Can't split segment into length 0" failed

[Hiromasa Ito]

URL:
  <https://savannah.nongnu.org/bugs/?57379>

                 Summary: Assertion "Can't split segment into length 0" failed
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: vhertz
            Submitted on: Sat 07 Dec 2019 01:21:24 PM UTC
                Category: TCP
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: Other

    _______________________________________________________

Details:

Hi, all.

This is one of the assertion failures I found by fuzzing (to lwIP
ver2.1.0.RC1).
The following LWIP_ASSERT() at lwip/src/core/tcp_out.c:851 fails.


if (split == 0) {
  LWIP_ASSERT("Can't split segment into length 0", 0);
  return ERR_VAL;
}


This code is written in tcp_split_unsent_seg(), 
and that is called from tcp_slowtmr() as below:


if (tcp_split_unsent_seg(pcb, (u16_t)pcb->snd_wnd) == ERR_OK) {


The 2nd argument of tcp_split_unsent_seg() is `split`.
If LWIP_WND_SCALE is defined, `pcb->snd_wnd` has 32-bit value.
If the lower 16bit of it is 0x0000, the value of `split` becomes 0x0000.
For example, if the value of `pcb->snd_wnd` is 0xffff0000, that of `split` is
0x0000.

As a result, the assertion fails.

You can reproduce this failure with 'crashed_inputs/008', attached to the
following message of lwip-devel:
https://lists.nongnu.org/archive/html/lwip-devel/2019-12/msg00013.html




    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?57379>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/