You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
What steps will reproduce the problem?
1. Send a large number of UDP packets of size > HONEYD_MTU which cause
fragmentation over Honeyd proxy.
2. Watch as memory corruption occurs - the pool_alloc function will return
an entry with entry->data set to an invalid pointer.
3. Honeyd will crash in memcpy function in ipfrag.c - ip_send_fragments due
to the returned pointer from pool_alloc being invalid.
What is the expected output? What do you see instead?
Honeyd should be able to handle UDP packets > MTU without crashing.
What version of the product are you using? On what operating system?
Honeyd 1.5c, Linux.
Please provide any additional information below.
When allocating udp packets in the udp_send function in honeyd.c, if the
size of the packet is greater than the pool size, it should use
pool_alloc_size instead of pool_alloc in order to allocate the correct size
pointer. Otherwise it will return a chunk of memory too small to
accommodate the data, and the pool will get corrupted.
Here is a patch which seems to address the problem:
ip_personality(tmpl, &id);
- pkt = pool_alloc(pool_pkt);
+ iplen = IP_HDR_LEN + UDP_HDR_LEN + len;
+ if (iplen <= HONEYD_MTU)
+ pkt = pool_alloc(pool_pkt);
+ else
+ pkt = pool_alloc_size(pool_pkt, iplen);
+
udp = (struct udp_hdr *)(pkt + IP_HDR_LEN);
udp_pack_hdr(udp, con->con_dport, con->con_sport, UDP_HDR_LEN + len);
- iplen = IP_HDR_LEN + UDP_HDR_LEN + len;
-
/* Src and Dst are reversed both for ip and tcp */
ip_pack_hdr(pkt, 0, iplen, id,
dontfragment ? IP_DF : 0, honeyd_ttl,
Original issue reported on code.google.com by pkwar...@gmail.com on 13 Jul 2009 at 5:46
The text was updated successfully, but these errors were encountered:
Original issue reported on code.google.com by
pkwar...@gmail.com
on 13 Jul 2009 at 5:46The text was updated successfully, but these errors were encountered: