icmp: Fix copied length in response packets

Fixes bug #59364, reported by Yi Guai
This commit is contained in:
Erik Ekman
2021-01-13 20:31:55 +01:00
parent c6777547f6
commit 35550eeab3
2 changed files with 67 additions and 9 deletions

View File

@@ -1,5 +1,6 @@
#include "test_ip4.h"
#include "lwip/icmp.h"
#include "lwip/ip4.h"
#include "lwip/etharp.h"
#include "lwip/inet_chksum.h"
@@ -17,6 +18,8 @@ static struct netif test_netif;
static ip4_addr_t test_ipaddr, test_netmask, test_gw;
static int linkoutput_ctr;
static int linkoutput_byte_ctr;
static int linkoutput_pkt_len;
static u8_t linkoutput_pkt[100];
/* reference internal lwip variable in netif.c */
@@ -27,6 +30,8 @@ test_netif_linkoutput(struct netif *netif, struct pbuf *p)
fail_unless(p != NULL);
linkoutput_ctr++;
linkoutput_byte_ctr += p->tot_len;
/* Copy start of packet into buffer */
linkoutput_pkt_len = pbuf_copy_partial(p, linkoutput_pkt, sizeof(linkoutput_pkt), 0);
return ERR_OK;
}
@@ -264,6 +269,54 @@ START_TEST(test_ip4addr_aton)
}
END_TEST
/* Test for bug #59364 */
START_TEST(test_ip4_icmp_replylen_short)
{
/* IP packet to 192.168.0.1 using proto 0x22 and 1 byte payload */
const u8_t unknown_proto[] = {
0x45, 0x00, 0x00, 0x15, 0xd4, 0x31, 0x00, 0x00, 0xff, 0x22,
0x66, 0x41, 0xc0, 0xa8, 0x00, 0x02, 0xc0, 0xa8, 0x00, 0x01,
0xaa };
struct pbuf *p;
const int icmp_len = IP_HLEN + sizeof(struct icmp_hdr);
test_netif_add();
test_netif.output = arpless_output;
p = pbuf_alloc(PBUF_IP, sizeof(unknown_proto), PBUF_RAM);
pbuf_take(p, unknown_proto, sizeof(unknown_proto));
fail_unless(ip4_input(p, &test_netif) == ERR_OK);
fail_unless(linkoutput_ctr == 1);
/* Verify outgoing ICMP packet has no extra data */
fail_unless(linkoutput_byte_ctr == icmp_len + sizeof(unknown_proto));
fail_if(memcmp(&linkoutput_pkt[icmp_len], unknown_proto, sizeof(unknown_proto)));
}
END_TEST
START_TEST(test_ip4_icmp_replylen_first_8)
{
/* IP packet to 192.168.0.1 using proto 0x22 and 11 bytes payload */
const u8_t unknown_proto[] = {
0x45, 0x00, 0x00, 0x1f, 0xd4, 0x31, 0x00, 0x00, 0xff, 0x22,
0x66, 0x37, 0xc0, 0xa8, 0x00, 0x02, 0xc0, 0xa8, 0x00, 0x01,
0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9,
0xaa };
struct pbuf *p;
const int icmp_len = IP_HLEN + sizeof(struct icmp_hdr);
const int unreach_len = IP_HLEN + 8;
test_netif_add();
test_netif.output = arpless_output;
p = pbuf_alloc(PBUF_IP, sizeof(unknown_proto), PBUF_RAM);
pbuf_take(p, unknown_proto, sizeof(unknown_proto));
fail_unless(ip4_input(p, &test_netif) == ERR_OK);
fail_unless(linkoutput_ctr == 1);
fail_unless(linkoutput_byte_ctr == icmp_len + unreach_len);
fail_if(memcmp(&linkoutput_pkt[icmp_len], unknown_proto, IP_HLEN + 8));
}
END_TEST
/** Create the suite including all tests for this module */
Suite *
ip4_suite(void)
@@ -273,6 +326,8 @@ ip4_suite(void)
TESTFUNC(test_ip4_reass),
TESTFUNC(test_127_0_0_1),
TESTFUNC(test_ip4addr_aton),
TESTFUNC(test_ip4_icmp_replylen_short),
TESTFUNC(test_ip4_icmp_replylen_first_8),
};
return create_suite("IPv4", tests, sizeof(tests)/sizeof(testfunc), ip4_setup, ip4_teardown);
}