Skip to content

wrong checksum on receiving ICMP echo request, negative payload length #645

@benpicco

Description

@benpicco

I'm sending an ICMP echo request like this

icmpv6_send_echo_request(dest, id, i, payload, sizeof payload);

where payload is a 7 byte string array.

The packet is sent with a total length of 18 bytes in sixlowpan_lowpan_sendto, header compression is active.

2014-02-07 03:43:13,820 - INFO # INFO: send echo request to: fe80:0000:0000:0000:3612:00ff:fe00:00fc
2014-02-07 03:43:13,824 - INFO # Not fragmented, len = 18

However on the receiving side something goes wrong as first indicated by the wrong checksum warning, ipv6_buf->length is 15 bytes.

When the payload size is calculated in recv_echo_req, too much is subtracted, resulting in an underflow of data_len which makes the subsequent loop go on for quite a while.

2014-02-07 03:38:56,328 - INFO # Calculate checksum over src: fe80:0000:0000:0000:3612:00ff:fe00:00fc, dst: fe80:0000:0000:0000:3612:00ff:fe00:00fc, len: 000F, buf: 0x40005018, proto: 58
2014-02-07 03:38:56,332 - INFO # ERROR: wrong checksum (len = 15)
2014-02-07 03:38:56,338 - INFO # INFO: packet type: icmp echo request
2014-02-07 03:38:56,347 - INFO # INFO: received echo request (4294967263 (15) byte) from: fe80:0000:0000:0000:3612:00ff:fe00:00fd
2014-02-07 03:38:56,349 - INFO # 
2014-02-07 03:38:56,353 - INFO # id = 0x0001, seq = 0
2014-02-07 03:38:56,356 - INFO # 66 
2014-02-07 03:38:56,358 - INFO # 6f 
2014-02-07 03:38:56,361 - INFO # 6f 
2014-02-07 03:38:56,363 - INFO # 62 
…

Metadata

Metadata

Assignees

Labels

Type: bugThe issue reports a bug / The PR fixes a bug (including spelling errors)

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions