diff options
| author | Hideaki Yoshifuji <yoshfuji@linux-ipv6.org> | 2004-02-16 06:45:02 -0800 |
|---|---|---|
| committer | Hideaki Yoshifuji <yoshfuji@linux-ipv6.org> | 2004-02-16 06:45:02 -0800 |
| commit | 1fbe8eb85cbbe9bef0903aebc6eda2482df47b7d (patch) | |
| tree | ea3d8e3b3e811274c40344aca577a98d454b274d | |
| parent | 9dc49036c973b0aefd0225201573f377cd378476 (diff) | |
[NETFILTER]: Fix signedness overflow in ip{,6}_tables.c
Bug discovered by Olaf Kirch.
| -rw-r--r-- | net/ipv4/netfilter/ip_tables.c | 15 | ||||
| -rw-r--r-- | net/ipv6/netfilter/ip6_tables.c | 3 |
2 files changed, 12 insertions, 6 deletions
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index a7103ccae8d6..1c1207164e1c 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1529,11 +1529,16 @@ tcp_match(const struct sk_buff *skb, == tcpinfo->flg_cmp, IPT_TCP_INV_FLAGS)) return 0; - if (tcpinfo->option && - !tcp_find_option(tcpinfo->option, skb, tcph.doff*4 - sizeof(tcph), - tcpinfo->invflags & IPT_TCP_INV_OPTION, - hotdrop)) - return 0; + if (tcpinfo->option) { + if (tcph.doff * 4 < sizeof(tcph)) { + *hotdrop = 1; + return 0; + } + if (!tcp_find_option(tcpinfo->option, skb, tcph.doff*4 - sizeof(tcph), + tcpinfo->invflags & IPT_TCP_INV_OPTION, + hotdrop)) + return 0; + } return 1; } diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index 24b0565a0e9e..0adb7785c761 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -1545,7 +1545,8 @@ tcp_find_option(u_int8_t option, duprintf("tcp_match: finding option\n"); /* If we don't have the whole header, drop packet. */ - if (tcp->doff * 4 > datalen) { + if (tcp->doff * 4 < sizeof(struct tcphdr) || + tcp->doff * 4 > datalen) { *hotdrop = 1; return 0; } |