From 279b117202723c5dbb3f701e6bc23daf8486fda7 Mon Sep 17 00:00:00 2001 From: David Cermak Date: Thu, 18 Jun 2026 12:59:56 +0200 Subject: [PATCH 1/3] fix(lwip): reject invalid DHCP MTU option values Validate MTU from DHCP option 26 against RFC 2132 minimum (68 bytes) before applying to netif->mtu, preventing rogue DHCP servers from setting MTU to 0 or other dangerously low values that cause integer wraparound in IPv4 fragmentation. --- components/lwip/port/hooks/lwip_default_hooks.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/components/lwip/port/hooks/lwip_default_hooks.c b/components/lwip/port/hooks/lwip_default_hooks.c index 1ec6e75814f..ee5f5332e01 100644 --- a/components/lwip/port/hooks/lwip_default_hooks.c +++ b/components/lwip/port/hooks/lwip_default_hooks.c @@ -234,6 +234,9 @@ void dhcp_parse_extra_opts(struct dhcp *dhcp, uint8_t state, uint8_t option, uin NETIF_FOREACH(netif) { /* find the netif related to this dhcp */ if (dhcp == netif_dhcp_data(netif)) { + if (mtu < 68) { /* RFC 2132 requires MTU >= 68 */ + return; + } if (mtu < netif->mtu) { netif->mtu = mtu; LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE, ("dhcp_parse_extra_opts(): Negotiated netif MTU is %d\n", netif->mtu)); From 26c44b765f76df8e89f8394c3cad176d89b62353 Mon Sep 17 00:00:00 2001 From: David Cermak Date: Tue, 23 Jun 2026 14:28:51 +0200 Subject: [PATCH 2/3] fix(lwip): Adds nullchecks after DHCP server alloc'd pools --- components/lwip/apps/dhcpserver/dhcpserver.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/components/lwip/apps/dhcpserver/dhcpserver.c b/components/lwip/apps/dhcpserver/dhcpserver.c index 58ceae910ee..30ff278aa02 100644 --- a/components/lwip/apps/dhcpserver/dhcpserver.c +++ b/components/lwip/apps/dhcpserver/dhcpserver.c @@ -1197,11 +1197,19 @@ static s16_t parse_msg(dhcps_t *dhcps, struct dhcps_msg *m, u16_t len) pnode = NULL; } else { pdhcps_pool = (struct dhcps_pool *)mem_calloc(1, sizeof(struct dhcps_pool)); + if (pdhcps_pool == NULL) { + return 0; + } pdhcps_pool->ip.addr = dhcps->client_address.addr; memcpy(pdhcps_pool->mac, m->chaddr, sizeof(pdhcps_pool->mac)); pdhcps_pool->lease_timer = lease_timer; pnode = (list_node *)mem_calloc(1, sizeof(list_node)); + if (pnode == NULL) { + mem_free(pdhcps_pool); + pdhcps_pool = NULL; + return 0; + } pnode->pnode = pdhcps_pool; pnode->pnext = NULL; From af7543d00a4d7b489e010a70b59fd3d8022a40f4 Mon Sep 17 00:00:00 2001 From: David Cermak Date: Tue, 23 Jun 2026 14:18:19 +0200 Subject: [PATCH 3/3] fix(lwip): tcp/ooseq: do not accept empty fin seg (+ other fixes) * Update submodule: git log --oneline fd432e4e..c6f2f878 - test(lwip): add DHCP MTU validation unit test (espressif/esp-lwip@c6f2f878e) - ppp: fix potential oob read in VJ decompression (espressif/esp-lwip@2ff439e61) - ip6-frag: Fix incorrect memcpy size to the actual struct (espressif/esp-lwip@91ad363ba) - tcp/ooseq: do not accept empty fin seg (espressif/esp-lwip@fe4fb18c1) - Address review comments (espressif/esp-lwip@9d2d80412) - nd6: add static neighbor cache entry support (espressif/esp-lwip@a05a5cf3b) - dns: add addr_cnt to DNS resolution to fix multi-IP buffer overflow (espressif/esp-lwip@6233a1561) - ci: Add jira sync github workflows (espressif/esp-lwip@a4e2409d0) - feat(lwip): migrate to to PSA API interface (espressif/esp-lwip@20f8b0739) - test: Fix multiple defs of util vars (espressif/esp-lwip@e9b8482e7) - ci: Add support for building tests/apps with both gcc and clang (espressif/esp-lwip@2a14051bf) - try to fix unit test compiling with clang (espressif/esp-lwip@6933a63cb) - apps/snmp: Remove @retval tags on void methods (espressif/esp-lwip@b6209dcf8) - snmp: Mention struct field removal in UPGRADING (espressif/esp-lwip@6659cf1f2) - snmp: remove unused prev field from snmp_varbind (espressif/esp-lwip@f32188001) - snmp: remove handling of varbind->prev because it is never used (espressif/esp-lwip@46660d5cf) - snmp: fix dangling pointer in snmp_traps (espressif/esp-lwip@0e3e97f8d) --- components/lwip/lwip | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/lwip/lwip b/components/lwip/lwip index fd432e4ee2c..c6f2f878e7b 160000 --- a/components/lwip/lwip +++ b/components/lwip/lwip @@ -1 +1 @@ -Subproject commit fd432e4ee2cfb7f7f1c7eb7227e0173412e7b84e +Subproject commit c6f2f878e7b0f86033214b85547d579be43351e3