diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-06-10 19:51:31 -0400 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-06-10 19:55:07 -0400 |
commit | ed82c437320c48a4032492f4a55a7e2c934158b6 (patch) | |
tree | f86328e2d8d222989322f0a9d65e04218f3e531f /net | |
parent | a8241c63517ec0b900695daa9003cddc41c536a1 (diff) |
netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr()
In (bc6bcb5 netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond
packet boundary), the use of tcp_hdr was introduced. However, we
cannot assume that skb->transport_header is set for non-local packets.
Cc: Florian Westphal <fw@strlen.de>
Reported-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r-- | net/netfilter/xt_TCPOPTSTRIP.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/netfilter/xt_TCPOPTSTRIP.c b/net/netfilter/xt_TCPOPTSTRIP.c index 1eb1a44bfd3d..b68fa191710f 100644 --- a/net/netfilter/xt_TCPOPTSTRIP.c +++ b/net/netfilter/xt_TCPOPTSTRIP.c | |||
@@ -48,11 +48,13 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb, | |||
48 | return NF_DROP; | 48 | return NF_DROP; |
49 | 49 | ||
50 | len = skb->len - tcphoff; | 50 | len = skb->len - tcphoff; |
51 | if (len < (int)sizeof(struct tcphdr) || | 51 | if (len < (int)sizeof(struct tcphdr)) |
52 | tcp_hdr(skb)->doff * 4 > len) | ||
53 | return NF_DROP; | 52 | return NF_DROP; |
54 | 53 | ||
55 | tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff); | 54 | tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff); |
55 | if (tcph->doff * 4 > len) | ||
56 | return NF_DROP; | ||
57 | |||
56 | opt = (u_int8_t *)tcph; | 58 | opt = (u_int8_t *)tcph; |
57 | 59 | ||
58 | /* | 60 | /* |