mirror of
https://github.com/apache/nuttx.git
synced 2026-08-13 16:35:21 +00:00
8422531f93
In udp_input()'s broadcast/multicast fan-out loop, each iteration calls netdev_iob_replace(dev, iob) to swap in a freshly cloned iob before handing the packet to the next matching connection. That function unconditionally sets dev->d_len = iob->io_pktlen, which is the full frame length (IP + UDP headers + payload), undoing the 'dev->d_len -= udpiplen' done once before the loop to strip the headers off for udp_input_conn(). As a result, every connection after the first sees a d_len that is udpiplen (IP+UDP header length, eg 28 bytes for IPv4) too large. This value flows into udp_datahandler() as buflen (it reads dev->d_len directly) and is stored as the queued packet's declared length in the connection's read-ahead iob chain. Once more than one such oversized entry has queued up in the same chain, the consumer (udp_readahead() in udp_recvfrom.c) parses the following entry's metadata starting at the wrong offset, so whatever byte happens to land on src_addr_size is trusted as-is. That single byte (0-255) is then used as the length in iob_copyout(srcaddr, iob, src_addr_size, ...), which fills a fixed-size stack buffer with no bounds check outside a DEBUGASSERT - compiled out in release builds - so an oversized value overflows that stack buffer. Re-apply the same '-= udpiplen' header-stripping after each netdev_iob_replace() call in the loop, matching what's already done once before the loop for the first connection. Inside udp_input_conn, d_appdata is always set first, and since neither the ICMP nor ICMPv6 process accesses d_appdata, the redundant d_appdata settings have been removed. Signed-off-by: yi chen <94xhn1@gmail.com> |
||
|---|---|---|
| .. | ||
| arp | ||
| bluetooth | ||
| can | ||
| devif | ||
| icmp | ||
| icmpv6 | ||
| ieee802154 | ||
| igmp | ||
| inet | ||
| ipfilter | ||
| ipforward | ||
| ipfrag | ||
| local | ||
| mld | ||
| nat | ||
| neighbor | ||
| netdev | ||
| netfilter | ||
| netlink | ||
| pkt | ||
| procfs | ||
| route | ||
| rpmsg | ||
| sixlowpan | ||
| socket | ||
| tcp | ||
| udp | ||
| usrsock | ||
| utils | ||
| CMakeLists.txt | ||
| Kconfig | ||
| Makefile | ||
| net_initialize.c | ||