Skip to content

NetworkStack: TCP sequence number can overflow uint32 #138

Description

@maxhully

I saw a crash on an ERR_OUT_OF_RANGE with this traceback:

RangeError [ERR_OUT_OF_RANGE]: The value of "value" is out of range.
    at Buffer.writeUInt32BE
    at NetworkStack.sendTCP (.../gondolin/dist/src/qemu/network-stack.js:668:16)
    at NetworkStack.drainOutboundTcp (.../network-stack.js:989:22)
    at NetworkStack.handleTcpEnd (.../network-stack.js:1040:14)
    at .../gondolin/dist/src/qemu/http.js:108:32

I think this is because the TCP sequence and ack values (i.e. this.mySeq) are stored as good ol' JS numbers, but need to be uint32 values. So whenever we do arithmetic on sequence numbers we should do mod 2**32 so that the wraparound math works right. (I'm making some assumptions here.)

My clanker has this additional evidence from warning logs:

Before the crash, the harness emitted 289 Gondolin sandbox error warnings in three bursts. Every warning was an unsigned-32-bit overflow near the TCP sequence wrap boundary:

133 × Received 4_294_967_565
103 × Received 4_294_967_539
53 × Received 4_294_967_736

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions