TCP EOL option pad_len is in bits, not bytes

Bug #1494727 reported by Klaus Warnke on 2015-09-11
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
rohc
Status tracked in Rohc-main
Rohc-1.7.x
Medium
Didier Barvaux
Rohc-main
Medium
Didier Barvaux

Bug Description

Hello,

there is a conformance issue in d_tcp_parse_eol_dyn()
The pad_len is transmitted, for what reason ever, in bits, not bytes.
See rfc:

// nbits is bound to the remaining length (in bits) of TCP
// options, including the EOL type byte.
tcp_opt_eol(nbits)
{
...
  COMPRESSED eol_list_item {
    pad_len =:= compressed_value(8, nbits-8) [ 8 ];
  }
...
}

Therefore I suggest this change:

diff --git a/src/decomp/d_tcp_opts_list.c b/src/decomp/d_tcp_opts_list.c
index 0fef714..0bf92f6 100644
--- a/src/decomp/d_tcp_opts_list.c
+++ b/src/decomp/d_tcp_opts_list.c
@@ -776,7 +776,15 @@ static int d_tcp_parse_eol_dyn(const struct rohc_decomp_ctxt *const context,
                    "required for EOL option", data_len, eol_dyn_len);
   goto error;
  }
- eol_uncomp_len = data[0] + 1;
+ if ((data[0] % 8) != 0)
+ {
+ rohc_decomp_warn(context, "malformed TCP dynamic part: malformed TCP option "
+ "items: TCP EOL option has malformed pad_len %u bits, "
+ "not divisible by 8 (uncompleted byte)", data[0]);
+ goto error;
+ }
+
+ eol_uncomp_len = (data[0] / 8) + 1;
  if(eol_uncomp_len > max_opt_len)
  {
   rohc_decomp_warn(context, "malformed TCP dynamic part: malformed TCP option "

A test could be ipv4/tcp/afl11.
The second packet contains an EOL option.

Best,
Klaus Warnke

Klaus Warnke (k-warnke) on 2015-09-11
tags: added: tcp
Didier Barvaux (didier-barvaux) wrote :

You're right. My bad :-/

Your patch looks good. I'll add the compressor part, then push the fix in master for the 2.0.0 release.

Thank you for the report!

tags: added: conformance library
Didier Barvaux (didier-barvaux) wrote :

Fix pushed on master.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers