From 4ccd8953187aaa22278332a191f2a944b5f4437a Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Tue, 14 Sep 2004 20:20:55 -0700 Subject: [PATCH] [NETFILTER]: Fix tcp_find_option() bug properly. Signed-off-by: David S. Miller --- net/ipv4/netfilter/ip_tables.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index 1e23ea64b4ec1..8da90bdb37c2d 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1464,8 +1464,11 @@ tcp_find_option(u_int8_t option, unsigned int i; duprintf("tcp_match: finding option\n"); + + if (!optlen) + return invert; + /* If we don't have the whole header, drop packet. */ - BUG_ON(!optlen); op = skb_header_pointer(skb, skb->nh.iph->ihl*4 + sizeof(struct tcphdr), optlen, _opt); @@ -1534,7 +1537,7 @@ tcp_match(const struct sk_buff *skb, IPT_TCP_INV_FLAGS)) return 0; if (tcpinfo->option) { - if (th->doff * 4 <= sizeof(_tcph)) { + if (th->doff * 4 < sizeof(_tcph)) { *hotdrop = 1; return 0; } -- 2.53.0