summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorDmitry Popov <dp@highloadlab.com>2010-08-08 07:24:28 +0400
committerDavid S. Miller <davem@davemloft.net>2010-08-08 07:24:28 +0400
commitba78e2ddca844598c0efcbf2c76d73519a61b902 (patch)
tree2f775c059ab21f4c97d0aaa6ee18b79026f6ba40 /net
parente225567960db50e9810a152c8621c7a6ed94de71 (diff)
downloadlinux-ba78e2ddca844598c0efcbf2c76d73519a61b902.tar.xz
tcp: no md5sig option size check bug
tcp_parse_md5sig_option doesn't check md5sig option (TCPOPT_MD5SIG) length, but tcp_v[46]_inbound_md5_hash assume that it's at least 16 bytes long. Signed-off-by: Dmitry Popov <dp@highloadlab.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/tcp_input.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3c426cb318e7..e663b78a2ef6 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3930,7 +3930,7 @@ u8 *tcp_parse_md5sig_option(struct tcphdr *th)
if (opsize < 2 || opsize > length)
return NULL;
if (opcode == TCPOPT_MD5SIG)
- return ptr;
+ return opsize == TCPOLEN_MD5SIG ? ptr : NULL;
}
ptr += opsize - 2;
length -= opsize;