Prepare 2.1.2 release

(cherry picked from commit b0c753da96)

CHANGELOG

@@ -6,6 +6,22 @@ HISTORY
 
   * [Enter new changes just after this line - do not remove this line]
 
+(STABLE-2.1.2):
+
+  ++ Bugfixes:
+
+  2018-11-21: Jens Nielsen
+  * netbiosns.c: fix expecting too large packet (bug #55069)
+
+  2018-11-19: Dirk Ziegelmeier
+  * smtp.c: fix compiling with strict C compatibility because of strnlen (bug #55034)
+
+  2018-11-12: Simon Goldschmidt
+  * tcp.c: fix overflow check in tcp_recved triggering invalid assertion (bug #55015)
+
+  2018-11-12: Simon Goldschmidt
+  * tcp.c: fix a bug in sending RST segments (sent from port 0)
+
 (STABLE-2.1.1):
 
   ++ Bugfixes:

doc/doxygen/lwip.Doxyfile

@@ -38,7 +38,7 @@ PROJECT_NAME           = "lwIP"
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = "2.1.1"
+PROJECT_NUMBER         = "2.1.2"
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

src/Filelists.cmake

@@ -10,7 +10,7 @@
 
 set(LWIP_VERSION_MAJOR    "2")
 set(LWIP_VERSION_MINOR    "1")
-set(LWIP_VERSION_REVISION "1")
+set(LWIP_VERSION_REVISION "2")
 # LWIP_VERSION_RC is set to LWIP_RC_RELEASE for official releases
 # LWIP_VERSION_RC is set to LWIP_RC_DEVELOPMENT for Git versions
 # Numbers 1..31 are reserved for release candidates

src/apps/netbiosns/netbiosns.c

@@ -111,6 +111,22 @@ PACK_STRUCT_END
 #  include "arch/epstruct.h"
 #endif
 
+/** NetBIOS message question part */
+#ifdef PACK_STRUCT_USE_INCLUDES
+#  include "arch/bpstruct.h"
+#endif
+PACK_STRUCT_BEGIN
+struct netbios_question_hdr {
+  PACK_STRUCT_FLD_8(u8_t  nametype);
+  PACK_STRUCT_FLD_8(u8_t  encname[(NETBIOS_NAME_LEN * 2) + 1]);
+  PACK_STRUCT_FIELD(u16_t type);
+  PACK_STRUCT_FIELD(u16_t cls);
+} PACK_STRUCT_STRUCT;
+PACK_STRUCT_END
+#ifdef PACK_STRUCT_USE_INCLUDES
+#  include "arch/epstruct.h"
+#endif
+
 /** NetBIOS message name part */
 #ifdef PACK_STRUCT_USE_INCLUDES
 #  include "arch/bpstruct.h"
@@ -335,11 +351,11 @@ netbiosns_recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t
   /* if packet is valid */
   if (p != NULL) {
     char   netbios_name[NETBIOS_NAME_LEN + 1];
-    struct netbios_hdr      *netbios_hdr      = (struct netbios_hdr *)p->payload;
-    struct netbios_name_hdr *netbios_name_hdr = (struct netbios_name_hdr *)(netbios_hdr + 1);
+    struct netbios_hdr          *netbios_hdr          = (struct netbios_hdr *)p->payload;
+    struct netbios_question_hdr *netbios_question_hdr = (struct netbios_question_hdr *)(netbios_hdr + 1);
 
     /* is the packet long enough (we need the header in one piece) */
-    if (p->len < (sizeof(struct netbios_hdr) + sizeof(struct netbios_name_hdr))) {
+    if (p->len < (sizeof(struct netbios_hdr) + sizeof(struct netbios_question_hdr))) {
       /* packet too short */
       pbuf_free(p);
       return;
@@ -352,9 +368,9 @@ netbiosns_recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t
           ((netbios_hdr->flags & PP_NTOHS(NETB_HFLAG_RESPONSE)) == 0) &&
           (netbios_hdr->questions == PP_NTOHS(1))) {
         /* decode the NetBIOS name */
-        netbiosns_name_decode((char *)(netbios_name_hdr->encname), netbios_name, sizeof(netbios_name));
+        netbiosns_name_decode((char *)(netbios_question_hdr->encname), netbios_name, sizeof(netbios_name));
         /* check the request type */
-        if (netbios_name_hdr->type == PP_HTONS(NETB_QTYPE_NB)) {
+        if (netbios_question_hdr->type == PP_HTONS(NETB_QTYPE_NB)) {
           /* if the packet is for us */
           if (lwip_strnicmp(netbios_name, NETBIOS_LOCAL_NAME, sizeof(NETBIOS_LOCAL_NAME)) == 0) {
             struct pbuf *q;
@@ -376,10 +392,10 @@ netbiosns_recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t
               resp->resp_hdr.additionalRRs = 0;
 
               /* prepare NetBIOS header datas */
-              MEMCPY( resp->resp_name.encname, netbios_name_hdr->encname, sizeof(netbios_name_hdr->encname));
-              resp->resp_name.nametype     = netbios_name_hdr->nametype;
-              resp->resp_name.type         = netbios_name_hdr->type;
-              resp->resp_name.cls          = netbios_name_hdr->cls;
+              MEMCPY( resp->resp_name.encname, netbios_question_hdr->encname, sizeof(netbios_question_hdr->encname));
+              resp->resp_name.nametype     = netbios_question_hdr->nametype;
+              resp->resp_name.type         = netbios_question_hdr->type;
+              resp->resp_name.cls          = netbios_question_hdr->cls;
               resp->resp_name.ttl          = PP_HTONL(NETBIOS_NAME_TTL);
               resp->resp_name.datalen      = PP_HTONS(sizeof(resp->resp_name.flags) + sizeof(resp->resp_name.addr));
               resp->resp_name.flags        = PP_HTONS(NETB_NFLAG_NODETYPE_BNODE);
@@ -393,7 +409,7 @@ netbiosns_recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t
             }
           }
 #if LWIP_NETBIOS_RESPOND_NAME_QUERY
-        } else if (netbios_name_hdr->type == PP_HTONS(NETB_QTYPE_NBSTAT)) {
+        } else if (netbios_question_hdr->type == PP_HTONS(NETB_QTYPE_NBSTAT)) {
           /* if the packet is for us or general query */
           if (!lwip_strnicmp(netbios_name, NETBIOS_LOCAL_NAME, sizeof(NETBIOS_LOCAL_NAME)) ||
               !lwip_strnicmp(netbios_name, "*", sizeof(NETBIOS_LOCAL_NAME))) {
@@ -419,9 +435,9 @@ netbiosns_recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t
               /* resp->answer_hdr.authorityRRs    = PP_HTONS(0); done by memset() */
               /* resp->answer_hdr.additionalRRs   = PP_HTONS(0); done by memset() */
               /* we will copy the length of the station name */
-              resp->name_size                  = netbios_name_hdr->nametype;
+              resp->name_size                  = netbios_question_hdr->nametype;
               /* we will copy the queried name */
-              MEMCPY(resp->query_name, netbios_name_hdr->encname, (NETBIOS_NAME_LEN * 2) + 1);
+              MEMCPY(resp->query_name, netbios_question_hdr->encname, (NETBIOS_NAME_LEN * 2) + 1);
               /* NBSTAT */
               resp->packet_type                = PP_HTONS(0x21);
               /* Internet name */

src/apps/smtp/smtp.c

@@ -65,7 +65,7 @@
 #include "lwip/altcp_tcp.h"
 #include "lwip/altcp_tls.h"
 
-#include <string.h> /* strnlen, memcpy */
+#include <string.h> /* strlen, memcpy */
 #include <stdlib.h>
 
 /** TCP poll interval. Unit is 0.5 sec. */
@@ -353,9 +353,8 @@ smtp_set_server_addr(const char* server)
   LWIP_ASSERT_CORE_LOCKED();
 
   if (server != NULL) {
-    /* strnlen: returns length WITHOUT terminating 0 byte OR
-     * SMTP_MAX_SERVERNAME_LEN+1 when string is too long */
-    len = strnlen(server, SMTP_MAX_SERVERNAME_LEN+1);
+    /* strlen: returns length WITHOUT terminating 0 byte */
+    len = strlen(server);
   }
   if (len > SMTP_MAX_SERVERNAME_LEN) {
     return ERR_MEM;

src/core/tcp.c

@@ -978,23 +978,13 @@ tcp_recved(struct tcp_pcb *pcb, u16_t len)
   LWIP_ASSERT("don't call tcp_recved for listen-pcbs",
               pcb->state != LISTEN);
 
-  rcv_wnd = pcb->rcv_wnd + len;
-  if (rcv_wnd < pcb->rcv_wnd || (len != 0 && rcv_wnd == pcb->rcv_wnd)) {
-    /* rcv_wnd overflowed */
-    if (TCP_STATE_IS_CLOSING(pcb->state)) {
-      /* In passive close, we allow this, since the FIN bit is added to rcv_wnd
-         by the stack itself, since it is not mandatory for an application
-         to call tcp_recved() for the FIN bit, but e.g. the netconn API does so. */
-      pcb->rcv_wnd = TCP_WND_MAX(pcb);
-    } else {
-      LWIP_ASSERT("tcp_recved: len wrapped rcv_wnd\n", 0);
-    }
-  } else if (rcv_wnd <= TCP_WND_MAX(pcb)) {
-    pcb->rcv_wnd = rcv_wnd;
-  } else {
-    LWIP_ASSERT("tcp_recved: len overflowed TCP_WND_MAX",
-		rcv_wnd <= TCP_WND_MAX(pcb));
+  rcv_wnd = (tcpwnd_size_t)(pcb->rcv_wnd + len);
+  if ((rcv_wnd > TCP_WND_MAX(pcb)) || (rcv_wnd < pcb->rcv_wnd)) {
+    /* window got too big or tcpwnd_size_t overflow */
+    LWIP_DEBUGF(TCP_DEBUG, ("tcp_recved: window got too big or tcpwnd_size_t overflow\n"));
     pcb->rcv_wnd = TCP_WND_MAX(pcb);
+  } else  {
+    pcb->rcv_wnd = rcv_wnd;
   }
 
   wnd_inflation = tcp_update_rcv_ann_wnd(pcb);

src/include/lwip/init.h

@@ -54,7 +54,7 @@ extern "C" {
 /** x.X.x: Minor version of the stack */
 #define LWIP_VERSION_MINOR      1
 /** x.x.X: Revision of the stack */
-#define LWIP_VERSION_REVISION   1
+#define LWIP_VERSION_REVISION   2
 /** For release candidates, this is set to 1..254
   * For official releases, this is set to 255 (LWIP_RC_RELEASE)
   * For development versions (Git), this is set to 0 (LWIP_RC_DEVELOPMENT) */