espressif/esp-lwip
1
0
Fork 0
mirror of https://github.com/espressif/esp-lwip.git synced 2026-09-13 04:30:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

tcp_in: Fix for potential segment overflow

Browse Source 
2.1.3-esp: 9d6459ec tcp_in: Fix for potential segment overflow
This commit is contained in:
xueyunfei
2024-09-10 16:41:03 +02:00
committed by David Cermak
parent 73a598fcd8
commit 814c00f51a
1 changed files with 28 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/tcp_in.c
+28 -1
View File
@@ -1580,7 +1580,23 @@ tcp_receive(struct tcp_pcb *pcb)
struct tcp_seg *cseg = pcb->ooseq;
seqno = pcb->ooseq->tcphdr->seqno;
#if ESP_LWIP
if (pcb->rcv_wnd < TCP_TCPLEN(cseg)) {
LWIP_DEBUGF(TCP_INPUT_DEBUG,
("tcp_receive: OOSEQ packet out of wnd "
"seqno=%"U32_F" wnd =%"U32_F" len=%"U16_F
"snd_wl1=%"U32_F" snd_wl2 =%"U32_F" f = %"X16_F" tf=%"U16_F"\n",
seqno,pcb->rcv_wnd,cseg->len,pcb->snd_wl1,pcb->snd_wl1,
TCPH_FLAGS((cseg)->tcphdr),pcb->flags));
cseg->len = pcb->rcv_wnd;
if((TCPH_FLAGS((cseg)->tcphdr) & TCP_SYN) || (TCPH_FLAGS((cseg)->tcphdr) & TCP_FIN)) {
cseg->len -= 1;
}
pbuf_realloc(cseg->p, cseg->len);
tcp_segs_free(cseg->next);
cseg->next = NULL;
}
#endif /* ESP_LWIP */
pcb->rcv_nxt += TCP_TCPLEN(cseg);
LWIP_ASSERT("tcp_receive: ooseq tcplen > rcv_wnd",
pcb->rcv_wnd >= TCP_TCPLEN(cseg));
@@ -1785,6 +1801,17 @@ tcp_receive(struct tcp_pcb *pcb)
}
/* Adjust length of segment to fit in the window. */
next->next->len = (u16_t)(pcb->rcv_nxt + pcb->rcv_wnd - seqno);
#if ESP_LWIP
if (TCPH_FLAGS(next->next->tcphdr) & TCP_SYN) {
LWIP_DEBUGF(TCP_INPUT_DEBUG,
("tcp_receive: ooseq not trimmed correctly to rcv_wnd "
"seqno=%"U32_F" wnd =%"U32_F" len=%"U16_F
"snd_wl1=%"U32_F" snd_wl2 =%"U32_F" f = %"X16_F" tf=%"U16_F"\n",
seqno,pcb->rcv_wnd,next->next->len,pcb->snd_wl1,pcb->snd_wl1,
TCPH_FLAGS(next->next->tcphdr),pcb->flags));
next->next->len -= 1;
}
#endif /* ESP_LWIP */
pbuf_realloc(next->next->p, next->next->len);
tcplen = TCP_TCPLEN(next->next);
LWIP_ASSERT("tcp_receive: segment not trimmed correctly to rcv_wnd",