patch-2.4.7 linux/net/ipv4/netfilter/ipt_unclean.c
Next file: linux/net/ipv4/netfilter/iptable_mangle.c
Previous file: linux/net/ipv4/netfilter/ip_queue.c
Back to the patch index
Back to the overall index
- Lines: 34
- Date:
Fri Jul 6 17:07:55 2001
- Orig file:
v2.4.6/linux/net/ipv4/netfilter/ipt_unclean.c
- Orig date:
Tue Jul 3 17:08:22 2001
diff -u --recursive --new-file v2.4.6/linux/net/ipv4/netfilter/ipt_unclean.c linux/net/ipv4/netfilter/ipt_unclean.c
@@ -268,6 +268,7 @@
int embedded)
{
u_int8_t *opt = (u_int8_t *)tcph;
+ u_int8_t *endhdr = (u_int8_t *)tcph + tcph->doff * 4;
u_int8_t tcpflags;
int end_of_options = 0;
size_t i;
@@ -373,7 +374,7 @@
return 0;
}
/* CHECK: oversize options. */
- else if (opt[i+1] + i >= tcph->doff * 4) {
+ else if (&opt[i] + opt[i+1] > endhdr) {
limpk("TCP option %u at %Zu too long\n",
(unsigned int) opt[i], i);
return 0;
@@ -392,6 +393,7 @@
check_ip(struct iphdr *iph, size_t length, int embedded)
{
u_int8_t *opt = (u_int8_t *)iph;
+ u_int8_t *endhdr = (u_int8_t *)iph + iph->ihl * 4;
int end_of_options = 0;
void *protoh;
size_t datalen;
@@ -444,7 +446,7 @@
return 0;
}
/* CHECK: oversize options. */
- else if (opt[i+1] + i > iph->ihl * 4) {
+ else if (&opt[i] + opt[i+1] > endhdr) {
limpk("IP option %u at %u too long\n",
opt[i], i);
return 0;
FUNET's LINUX-ADM group, linux-adm@nic.funet.fi
TCL-scripts by Sam Shen (who was at: slshen@lbl.gov)