From 1fbe8eb85cbbe9bef0903aebc6eda2482df47b7d Mon Sep 17 00:00:00 2001 From: Hideaki Yoshifuji Date: Mon, 16 Feb 2004 06:45:02 -0800 Subject: [PATCH] [NETFILTER]: Fix signedness overflow in ip{,6}_tables.c Bug discovered by Olaf Kirch. --- net/ipv4/netfilter/ip_tables.c | 15 ++++++++++----- net/ipv6/netfilter/ip6_tables.c | 3 ++- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index a7103ccae8d64..1c1207164e1cf 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1529,11 +1529,16 @@ tcp_match(const struct sk_buff *skb, == tcpinfo->flg_cmp, IPT_TCP_INV_FLAGS)) return 0; - if (tcpinfo->option && - !tcp_find_option(tcpinfo->option, skb, tcph.doff*4 - sizeof(tcph), - tcpinfo->invflags & IPT_TCP_INV_OPTION, - hotdrop)) - return 0; + if (tcpinfo->option) { + if (tcph.doff * 4 < sizeof(tcph)) { + *hotdrop = 1; + return 0; + } + if (!tcp_find_option(tcpinfo->option, skb, tcph.doff*4 - sizeof(tcph), + tcpinfo->invflags & IPT_TCP_INV_OPTION, + hotdrop)) + return 0; + } return 1; } diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index 24b0565a0e9e4..0adb7785c7610 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -1545,7 +1545,8 @@ tcp_find_option(u_int8_t option, duprintf("tcp_match: finding option\n"); /* If we don't have the whole header, drop packet. */ - if (tcp->doff * 4 > datalen) { + if (tcp->doff * 4 < sizeof(struct tcphdr) || + tcp->doff * 4 > datalen) { *hotdrop = 1; return 0; } -- 2.53.0