CVE-2020-17437

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other
products. When the Urgent flag is set in a TCP packet, and the stack is
configured to ignore the urgent data, the stack attempts to use the value
of the Urgent pointer bytes to separate the Urgent data from the normal
data, by calculating the offset at which the normal data should be present
in the global buffer. However, the length of this offset is not checked;
therefore, for large values of the Urgent pointer bytes, the data pointer
can point to memory that is way beyond the data buffer in uip_process in
uip.c.

Notes