diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-06-11 01:51:31 +0200 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2018-02-13 18:32:21 +0000 |
| commit | 3cdd962a56dea077e57c82c319c8244bcc01693a (patch) | |
| tree | c2d333f10ab0863ab77cc542d4897407075e679a | |
| parent | 24a6ca9612ff55f0608196663f843ee4f52ce28b (diff) | |
netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr()
commit ed82c437320c48a4032492f4a55a7e2c934158b6 upstream.
In (bc6bcb5 netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond
packet boundary), the use of tcp_hdr was introduced. However, we
cannot assume that skb->transport_header is set for non-local packets.
Cc: Florian Westphal <fw@strlen.de>
Reported-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | net/netfilter/xt_TCPOPTSTRIP.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/netfilter/xt_TCPOPTSTRIP.c b/net/netfilter/xt_TCPOPTSTRIP.c index 052ccc24f2a1..817ffa7980c3 100644 --- a/net/netfilter/xt_TCPOPTSTRIP.c +++ b/net/netfilter/xt_TCPOPTSTRIP.c @@ -48,11 +48,13 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb, return NF_DROP; len = skb->len - tcphoff; - if (len < (int)sizeof(struct tcphdr) || - tcp_hdr(skb)->doff * 4 > len) + if (len < (int)sizeof(struct tcphdr)) return NF_DROP; tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff); + if (tcph->doff * 4 > len) + return NF_DROP; + opt = (u_int8_t *)tcph; /* |