Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a206bcb3 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: xt_TCPOPTSTRIP: fix possible off by one access 



Fix a possible off by one access since optlen()
touches opt[offset+1] unsafely when i == tcp_hdrlen(skb) - 1.

This patch replaces tcp_hdrlen() by the local variable tcp_hdrlen
that stores the TCP header length, to save some cycles.

Reported-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 71ffe9c7

net/netfilter/xt_TCPOPTSTRIP.c

+6 −4
Original line number Diff line number Diff line
@@ -38,7 +38,7 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb, 
	struct tcphdr *tcph;

	u_int16_t n, o;

	u_int8_t *opt;

	int len;

	int len, tcp_hdrlen;



	/* This is a fragment, no TCP header is available */

	if (par->fragoff != 0)
@@ -52,7 +52,9 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb, 
		return NF_DROP;



	tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);

	if (tcph->doff * 4 > len)

	tcp_hdrlen = tcph->doff * 4;



	if (len < tcp_hdrlen)

		return NF_DROP;



	opt  = (u_int8_t *)tcph;
@@ -61,10 +63,10 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb, 
	 * Walk through all TCP options - if we find some option to remove,

	 * set all octets to %TCPOPT_NOP and adjust checksum.

	 */

	for (i = sizeof(struct tcphdr); i < tcp_hdrlen(skb); i += optl) {

	for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {

		optl = optlen(opt, i);



		if (i + optl > tcp_hdrlen(skb))

		if (i + optl > tcp_hdrlen)

			break;



		if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))