On 1/15/20 8:19 PM, Vincent Li wrote:
>
> 59 if (tcphdr->syn) {
>
> 60 if (((void *)(tcphdr + 1) + tcphdr->doff*4) > data_end)
>
> 61 return 0;
>
> 62 optlen = tcphdr->doff*4 - sizeof(*tcphdr);
>
> 63 for (i = 0; i < optlen; ) {
A variable length loop counter. Change this to just look at i = 0 (no
loop) and see if it loads.
|