ulDNSHandlePacket() - check length before calculating payload size #1615
Conversation
| uxPayloadSize, | ||
| pdFALSE ); | ||
| } | ||
| } | ||
|
|
||
| /* The packet was not consumed. */ | ||
| return pdFAIL; |
There was a problem hiding this comment.
Call me crazy, but why have a return value if it can never be anything other than pdFAIL?
There was a problem hiding this comment.
Even though this handler never consumes the buffer, the IP stack expects handling code to return a status value indicating whether or not the buffer was consumed.
|
Hello @gkwicker I think that your change doesn't add anything. The value of 'xDataLength' was proven to be at least the size of a
UDP packet in prvProcessIPPacket()When if( pxNetworkBuffer->xDataLength >= sizeof( UDPPacket_t ) )When you follow the flow of the program, you will see that the statement is always true. Now for the call-back ( a rarely used feature in FreeRTOS+TCP ), I had forgotten to subtract the size of the UDP packet. I think that you can safely drop this PR #1615. Thanks, Hein |
Detect integer overflow in
ulDNSHandlePacket().This PR fixes an integer overflow case introduced in an earlier commit and detected by a failing
ulDNSHandlePacket()test. See here for another example of this overflow detection logic.Checklist:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.