On Mon, 2012-04-02 at 11:10 +0800, Changli Gao wrote: > We should check the length of the data before dereferencing it when parsing > the TCP options. > > Signed-off-by: Changli Gao <xiaosuo@xxxxxxxxx> > --- > net/ipv4/tcp_input.c | 2 ++ > 1 file changed, 2 insertions(+) > diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c > index e886e2f..5099f08 100644 > --- a/net/ipv4/tcp_input.c > +++ b/net/ipv4/tcp_input.c > @@ -3845,6 +3845,8 @@ void tcp_parse_options(const struct sk_buff *skb, struct tcp_options_received *o > length--; > continue; > default: > + if (length < 2) > + return; > opsize = *ptr++; > if (opsize < 2) /* "silly options" */ > return; Acked-by: Eric Dumazet <eric.dumazet@xxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
