michaelh/zephyr
1
0
Fork 0
Code Releases Activity

net: uip: Traverse only through valid UDP connections

Browse source 
The uip6.c:uip_process() was not checking the upper bound of
the UDP connection list when traversing the connection list.
Now the code checks the upper bound of the array (UIP_UDP_CONNS)
and will not go beyond the max number of items in the array.

Change-Id: I417ffd2bbb54922ae071f2f382f7e9470516ce55
Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
This commit is contained in:
Jukka Rissanen 2015-06-25 12:39:30 +03:00 • committed by Anas Nashif
commit 4a21035141
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
net/ip/contiki/ipv6/uip6.c
View file

@ -956,6 +956,7 @@ uip_process(struct net_buf *buf, uint8_t flag)
register struct uip_conn *uip_connr = uip_conn;
#endif /* UIP_TCP */
#if UIP_UDP
int i;
if(flag == UIP_UDP_SEND_CONN) {
goto udp_send;
}
@ -1521,9 +1522,9 @@ uip_process(struct net_buf *buf, uint8_t flag)
}
/* Demultiplex this UDP packet between the UDP "connections". */
for(uip_set_udp_conn(buf) = &uip_udp_conns[0];
uip_udp_conn(buf) < &uip_udp_conns[UIP_UDP_CONNS];
++uip_set_udp_conn(buf)) {
for(i = 0, uip_set_udp_conn(buf) = &uip_udp_conns[0];
i < UIP_UDP_CONNS && uip_udp_conn(buf) < &uip_udp_conns[UIP_UDP_CONNS];
i++, ++uip_set_udp_conn(buf)) {
/* If the local UDP port is non-zero, the connection is considered
to be used. If so, the local port number is checked against the
destination port number in the received packet. If the two port