[lwip-devel] [bug #57376] Assertion "inconsistent oversize vs. space" failed

[Hiromasa Ito]

URL:
  <https://savannah.nongnu.org/bugs/?57376>

                 Summary: Assertion "inconsistent oversize vs. space" failed
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: vhertz
            Submitted on: Sat 07 Dec 2019 01:15:12 PM UTC
                Category: TCP
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: Other

    _______________________________________________________

Details:

Hi, all.

This is one of the assertion failures I found by fuzzing (to lwIP
ver2.1.0.RC1).
The following LWIP_ASSERT() at lwip/src/core/tcp_out.c:504 fails.


LWIP_ASSERT("inconsistent oversize vs. space", oversize <= space);


>From my point of view, this is caused by an incoming packet set MSS.
Before checking this assertion, the value of `space` and `oversize` are set as
below:


space = mss_local - (last_unsent->len + unsent_optlen);



oversize = pcb->unsent_oversize;


The value of `space` depends on MSS when tcp_write() is called.
On the other hand, the value of `oversize` depends on `pcb->unsent_oversize`
only.
In lwIP, incoming packets can change the MSS at an arbitrary timing.
As a result, the assertion can fail.

You can reproduce this failure with 'crashed_inputs/005' attached to the
following message of lwip-devel:
https://lists.nongnu.org/archive/html/lwip-devel/2019-12/msg00013.html




    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?57376>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/