BusyBox Bug and Patch Tracking
BusyBox
  

Viewing Issue Simple Details Jump to Notes ] View Advanced ] Issue History ] Print ]
ID Category Severity Reproducibility Date Submitted Last Update
0000309 [BusyBox] Networking Support minor always 06-25-05 13:08 01-10-06 20:40
Reporter Wutje View Status public  
Assigned To BusyBox
Priority normal Resolution fixed  
Status closed   Product Version 1.00
Summary 0000309: ping -s n localhost , with n smaller then 6 results in wrong timing results
Description ping -s n localhost , with n smaller then 6 results in wrong timing results
The error is the biggest when using -s 1,

Example:

ping -s 1 localhost
PING localhost.localdomain (127.0.0.1): 1 data bytes
9 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=416459759.4 ms
9 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=416459753.1 ms
9 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=416459753.1 ms
9 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=416459753.1 ms
Additional Information This seems like an overflow problem.
The busybox is running on a asus wl-500g router with custom firmware.

Using version:
BusyBox v1.00 (2005.05.11-18:29+0000)
Attached Files

- Relationships

- Notes
(0000713)
montezuma
11-29-05 13:46

In networking/ping.c there appears to be a bug that is causing this issue, or worse on some architectures/toolschains.

In the gettimeofday call the result is placed into the icmp data. The size of struct timeval is 8. packet is declared as "char packet[datalen + 8];", guess what happens if the datalen is < 8. The minimum datalen size should be the size of struct timeval.

gettimeofday((struct timeval *) &packet[8], NULL);


static void sendping(int junk)
{
    struct icmp *pkt;
    int i;
    char packet[datalen + 8];

    pkt = (struct icmp *) packet;

    pkt->icmp_type = ICMP_ECHO;
    pkt->icmp_code = 0;
    pkt->icmp_cksum = 0;
    pkt->icmp_seq = htons(ntransmitted++);
    pkt->icmp_id = myid;
    CLR(ntohs(pkt->icmp_seq) % MAX_DUP_CHK);

    gettimeofday((struct timeval *) &packet[8], NULL);
 
(0000922)
landley
01-10-06 20:40

svn 13234
 

- Issue History
Date Modified Username Field Change
06-25-05 13:08 Wutje New Issue
11-29-05 13:46 montezuma Note Added: 0000713
11-29-05 13:46 montezuma Issue Monitored: montezuma
01-10-06 20:40 landley Status assigned => closed
01-10-06 20:40 landley Note Added: 0000922
01-10-06 20:40 landley Resolution open => fixed
01-10-06 20:40 landley Fixed in Version  => svn


Copyright © 2000 - 2006 Mantis Group
Powered by Mantis Bugtracker