summaryrefslogtreecommitdiff
path: root/net/ipv4/cipso_ipv4.c
diff options
context:
space:
mode:
authoryujuan.qi <yujuan.qi@mediatek.com>2017-07-31 06:23:01 +0300
committerDavid S. Miller <davem@davemloft.net>2017-08-02 01:31:23 +0300
commit40413955ee265a5e42f710940ec78f5450d49149 (patch)
treee2e0c22b0f753899a3c190581bbbf6d392bc8a0b /net/ipv4/cipso_ipv4.c
parentfdaa419bb24cc191f2dce2ec19af1ef7c5076a36 (diff)
downloadlinux-40413955ee265a5e42f710940ec78f5450d49149.tar.xz
Cipso: cipso_v4_optptr enter infinite loop
in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop. Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com> Acked-by: Paul Moore <paul@paul-moore.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/cipso_ipv4.c')
-rw-r--r--net/ipv4/cipso_ipv4.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index c4c6e1969ed0..2ae8f54cb321 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1523,9 +1523,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
int taglen;
for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
- if (optptr[0] == IPOPT_CIPSO)
+ switch (optptr[0]) {
+ case IPOPT_CIPSO:
return optptr;
- taglen = optptr[1];
+ case IPOPT_END:
+ return NULL;
+ case IPOPT_NOOP:
+ taglen = 1;
+ break;
+ default:
+ taglen = optptr[1];
+ }
optlen -= taglen;
optptr += taglen;
}