be more cautious about tcp option length field. drop bogus ones earlier.
not sure if there is a real threat or not, but it seems that there's possibility for overrun/underrun (like non-NOP option with optlen > cnt).
This commit is contained in:
parent
e63b255aa6
commit
b474779f46
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=62846
@ -2329,8 +2329,10 @@ tcp_dooptions(tp, cp, cnt, th, to)
|
||||
if (opt == TCPOPT_NOP)
|
||||
optlen = 1;
|
||||
else {
|
||||
if (cnt < 2)
|
||||
break;
|
||||
optlen = cp[1];
|
||||
if (optlen <= 0)
|
||||
if (optlen < 2 || optlen > cnt)
|
||||
break;
|
||||
}
|
||||
switch (opt) {
|
||||
|
@ -2329,8 +2329,10 @@ tcp_dooptions(tp, cp, cnt, th, to)
|
||||
if (opt == TCPOPT_NOP)
|
||||
optlen = 1;
|
||||
else {
|
||||
if (cnt < 2)
|
||||
break;
|
||||
optlen = cp[1];
|
||||
if (optlen <= 0)
|
||||
if (optlen < 2 || optlen > cnt)
|
||||
break;
|
||||
}
|
||||
switch (opt) {
|
||||
|
Loading…
Reference in New Issue
Block a user