diff options
Diffstat (limited to 'net/dccp/options.c')
| -rw-r--r-- | net/dccp/options.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/net/dccp/options.c b/net/dccp/options.c index bedb5daaa3c5..d2a84a2fecee 100644 --- a/net/dccp/options.c +++ b/net/dccp/options.c | |||
| @@ -132,6 +132,8 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, | |||
| 132 | case DCCPO_CHANGE_L: | 132 | case DCCPO_CHANGE_L: |
| 133 | /* fall through */ | 133 | /* fall through */ |
| 134 | case DCCPO_CHANGE_R: | 134 | case DCCPO_CHANGE_R: |
| 135 | if (pkt_type == DCCP_PKT_DATA) | ||
| 136 | break; | ||
| 135 | if (len < 2) | 137 | if (len < 2) |
| 136 | goto out_invalid_option; | 138 | goto out_invalid_option; |
| 137 | rc = dccp_feat_change_recv(sk, opt, *value, value + 1, | 139 | rc = dccp_feat_change_recv(sk, opt, *value, value + 1, |
| @@ -148,7 +150,9 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, | |||
| 148 | case DCCPO_CONFIRM_L: | 150 | case DCCPO_CONFIRM_L: |
| 149 | /* fall through */ | 151 | /* fall through */ |
| 150 | case DCCPO_CONFIRM_R: | 152 | case DCCPO_CONFIRM_R: |
| 151 | if (len < 2) | 153 | if (pkt_type == DCCP_PKT_DATA) |
| 154 | break; | ||
| 155 | if (len < 2) /* FIXME this disallows empty confirm */ | ||
| 152 | goto out_invalid_option; | 156 | goto out_invalid_option; |
| 153 | if (dccp_feat_confirm_recv(sk, opt, *value, | 157 | if (dccp_feat_confirm_recv(sk, opt, *value, |
| 154 | value + 1, len - 1)) | 158 | value + 1, len - 1)) |