d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

be more cautious about tcp option length field. drop bogus ones earlier.

Browse Source 
not sure if there is a real threat or not, but it seems that there's
possibility for overrun/underrun (like non-NOP option with optlen > cnt).
This commit is contained in:
Jun-ichiro itojun Hagino 2000-07-09 13:01:59 +00:00
parent e63b255aa6
commit b474779f46
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=62846
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/netinet/tcp_input.c
View File

@ -2329,8 +2329,10 @@ tcp_dooptions(tp, cp, cnt, th, to)
if (opt == TCPOPT_NOP)
optlen = 1;
else {
if (cnt < 2)
break;
optlen = cp[1];
if (optlen <= 0)
if (optlen < 2 || optlen > cnt)
break;
}
switch (opt) {

4
sys/netinet/tcp_reass.c
View File

@ -2329,8 +2329,10 @@ tcp_dooptions(tp, cp, cnt, th, to)
if (opt == TCPOPT_NOP)
optlen = 1;
else {
if (cnt < 2)
break;
optlen = cp[1];
if (optlen <= 0)
if (optlen < 2 || optlen > cnt)
break;
}
switch (opt) {