On Sun, Apr 01, 2012 at 10:22:50PM +0800, Changli Gao wrote: > We should check the length of the data before dereferencing it when parsing > the TCP options. > > Signed-off-by: Changli Gao <xiaosuo@xxxxxxxxx> > --- > net/netfilter/nf_conntrack_proto_tcp.c | 4 ++++ > 1 file changed, 4 insertions(+) > diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c > index 361eade..9e446c5 100644 > --- a/net/netfilter/nf_conntrack_proto_tcp.c > +++ b/net/netfilter/nf_conntrack_proto_tcp.c > @@ -404,6 +404,8 @@ static void tcp_options(const struct sk_buff *skb, > length--; > continue; > default: > + if (length < 2) > + return; > opsize=*ptr++; > if (opsize < 2) /* "silly options" */ > return; length is always multiple of 4: int length = (tcph->doff*4) - sizeof(struct tcphdr); -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
