[lwip-devel] [bug #35756] header length calculation problem in ppp/vj.c

[Arne]

URL:
  <http://savannah.nongnu.org/bugs/?35756>

                 Summary: header length calculation problem in ppp/vj.c
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: alpharne
            Submitted on: Thu 08 Mar 2012 05:31:36 AM GMT
                Category: None
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 
            lwIP version: CVS Head

    _______________________________________________________

Details:

The TCPH_OFFSET calls in this file should be replaced by TCPH_HDRLEN.

Right now it uses the reserved bits and the length shifted left by 4 as header
length resulting in a possible overwriting of the internal structures as the
length can get beyond the maximum valid header length.





    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?35756>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/