TCP EOL option pad_len is in bits, not bytes

Bug #1494727 reported by Klaus Warnke on 2015-09-11
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Status tracked in Rohc-main
Didier Barvaux
Didier Barvaux

Bug Description


there is a conformance issue in d_tcp_parse_eol_dyn()
The pad_len is transmitted, for what reason ever, in bits, not bytes.
See rfc:

// nbits is bound to the remaining length (in bits) of TCP
// options, including the EOL type byte.
  COMPRESSED eol_list_item {
    pad_len =:= compressed_value(8, nbits-8) [ 8 ];

Therefore I suggest this change:

diff --git a/src/decomp/d_tcp_opts_list.c b/src/decomp/d_tcp_opts_list.c
index 0fef714..0bf92f6 100644
--- a/src/decomp/d_tcp_opts_list.c
+++ b/src/decomp/d_tcp_opts_list.c
@@ -776,7 +776,15 @@ static int d_tcp_parse_eol_dyn(const struct rohc_decomp_ctxt *const context,
                    "required for EOL option", data_len, eol_dyn_len);
   goto error;
- eol_uncomp_len = data[0] + 1;
+ if ((data[0] % 8) != 0)
+ {
+ rohc_decomp_warn(context, "malformed TCP dynamic part: malformed TCP option "
+ "items: TCP EOL option has malformed pad_len %u bits, "
+ "not divisible by 8 (uncompleted byte)", data[0]);
+ goto error;
+ }
+ eol_uncomp_len = (data[0] / 8) + 1;
  if(eol_uncomp_len > max_opt_len)
   rohc_decomp_warn(context, "malformed TCP dynamic part: malformed TCP option "

A test could be ipv4/tcp/afl11.
The second packet contains an EOL option.

Klaus Warnke

Klaus Warnke (k-warnke) on 2015-09-11
tags: added: tcp
Didier Barvaux (didier-barvaux) wrote :

You're right. My bad :-/

Your patch looks good. I'll add the compressor part, then push the fix in master for the 2.0.0 release.

Thank you for the report!

tags: added: conformance library
Didier Barvaux (didier-barvaux) wrote :

Fix pushed on master.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers