From 7856141fc48bb121ae2adcf257f36b3c01c7a1d0 Mon Sep 17 00:00:00 2001 From: tabascoeye Date: Mon, 15 Jun 2015 15:53:14 +0200 Subject: [PATCH] icmp: fix checksum on replies of echo request with ID 0, sequence 0 and either no data or any amount of 0x00 Bytes as data (closes: #45322) When a client sends an ICMP echo request with ID 0, sequence 0 and either no data or any amount of 0x00 bytes as data, the checksum in the reply is wrong (off-by-one). Expected checksum is 0xffff in that case, observed is 0x0000. --- src/core/ipv4/icmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/ipv4/icmp.c b/src/core/ipv4/icmp.c index 0df7dd40..19c9b0fd 100644 --- a/src/core/ipv4/icmp.c +++ b/src/core/ipv4/icmp.c @@ -196,7 +196,7 @@ icmp_input(struct pbuf *p, struct netif *inp) ICMPH_TYPE_SET(iecho, ICMP_ER); #if CHECKSUM_GEN_ICMP /* adjust the checksum */ - if (iecho->chksum >= PP_HTONS(0xffffU - (ICMP_ECHO << 8))) { + if (iecho->chksum > PP_HTONS(0xffffU - (ICMP_ECHO << 8))) { iecho->chksum += PP_HTONS(ICMP_ECHO << 8) + 1; } else { iecho->chksum += PP_HTONS(ICMP_ECHO << 8);