summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorgoldsimon <goldsimon>2008-03-26 11:57:12 +0000
committergoldsimon <goldsimon>2008-03-26 11:57:12 +0000
commitaee9c4c8e6c9ec54783f3657c40be96753c72dd9 (patch)
tree9c85b23343d221cb20c10f450ac00d5a61de12d3
parentbcb4afa886408bf0a1dde9c2a4a00323c8b07eb1 (diff)
downloadlwip-aee9c4c8e6c9ec54783f3657c40be96753c72dd9.tar.gz
fixed bug #22249: division by zero could occur if a remote host sent a zero mss as TCP option.
-rw-r--r--CHANGELOG4
-rw-r--r--src/core/tcp.c6
-rw-r--r--src/core/tcp_in.c3
3 files changed, 10 insertions, 3 deletions
diff --git a/CHANGELOG b/CHANGELOG
index 5567d5c..81f3823 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -22,6 +22,10 @@ HISTORY
++ Bugfixes:
+ 2008-03-26 Simon Goldschmidt
+ * tcp_in.c, tcp.c: fixed bug #22249: division by zero could occur if a remote
+ host sent a zero mss as TCP option.
+
(STABLE-1.3.0)
diff --git a/src/core/tcp.c b/src/core/tcp.c
index cfa0bd0..0c2c68f 100644
--- a/src/core/tcp.c
+++ b/src/core/tcp.c
@@ -509,7 +509,8 @@ tcp_connect(struct tcp_pcb *pcb, struct ip_addr *ipaddr, u16_t port,
pcb->rcv_wnd = TCP_WND;
pcb->rcv_ann_wnd = TCP_WND;
pcb->snd_wnd = TCP_WND;
- /* The send MSS is updated when an MSS option is received. */
+ /* As initial send MSS, we use TCP_MSS but limit it to 536.
+ The send MSS is updated when an MSS option is received. */
pcb->mss = (TCP_MSS > 536) ? 536 : TCP_MSS;
#if TCP_CALCULATE_EFF_SEND_MSS
pcb->mss = tcp_eff_send_mss(pcb->mss, ipaddr);
@@ -991,7 +992,8 @@ tcp_alloc(u8_t prio)
pcb->rcv_ann_wnd = TCP_WND;
pcb->tos = 0;
pcb->ttl = TCP_TTL;
- /* The send MSS is updated when an MSS option is received. */
+ /* As initial send MSS, we use TCP_MSS but limit it to 536.
+ The send MSS is updated when an MSS option is received. */
pcb->mss = (TCP_MSS > 536) ? 536 : TCP_MSS;
pcb->rto = 3000 / TCP_SLOW_INTERVAL;
pcb->sa = 0;
diff --git a/src/core/tcp_in.c b/src/core/tcp_in.c
index a06d9ae..cb12040 100644
--- a/src/core/tcp_in.c
+++ b/src/core/tcp_in.c
@@ -1331,7 +1331,8 @@ tcp_parseopt(struct tcp_pcb *pcb)
opts[c + 1] == 0x04) {
/* An MSS option with the right option length. */
mss = (opts[c + 2] << 8) | opts[c + 3];
- pcb->mss = mss > TCP_MSS? TCP_MSS: mss;
+ /* Limit the mss to the configured TCP_MSS and prevent division by zero */
+ pcb->mss = ((mss > TCP_MSS) || (mss == 0)) ? TCP_MSS : mss;
/* And we are done processing options. */
break;