aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2013-06-10 19:51:31 -0400
committerPablo Neira Ayuso <pablo@netfilter.org>2013-06-10 19:55:07 -0400
commited82c437320c48a4032492f4a55a7e2c934158b6 (patch)
treef86328e2d8d222989322f0a9d65e04218f3e531f /net
parenta8241c63517ec0b900695daa9003cddc41c536a1 (diff)
netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr()
In (bc6bcb5 netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary), the use of tcp_hdr was introduced. However, we cannot assume that skb->transport_header is set for non-local packets. Cc: Florian Westphal <fw@strlen.de> Reported-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/xt_TCPOPTSTRIP.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/net/netfilter/xt_TCPOPTSTRIP.c b/net/netfilter/xt_TCPOPTSTRIP.c
index 1eb1a44bfd3d..b68fa191710f 100644
--- a/net/netfilter/xt_TCPOPTSTRIP.c
+++ b/net/netfilter/xt_TCPOPTSTRIP.c
@@ -48,11 +48,13 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
48 return NF_DROP; 48 return NF_DROP;
49 49
50 len = skb->len - tcphoff; 50 len = skb->len - tcphoff;
51 if (len < (int)sizeof(struct tcphdr) || 51 if (len < (int)sizeof(struct tcphdr))
52 tcp_hdr(skb)->doff * 4 > len)
53 return NF_DROP; 52 return NF_DROP;
54 53
55 tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff); 54 tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
55 if (tcph->doff * 4 > len)
56 return NF_DROP;
57
56 opt = (u_int8_t *)tcph; 58 opt = (u_int8_t *)tcph;
57 59
58 /* 60 /*