diff options
| author | Jun-ichiro itojun Hagino <itojun@FreeBSD.org> | 2000-07-09 13:01:59 +0000 |
|---|---|---|
| committer | Jun-ichiro itojun Hagino <itojun@FreeBSD.org> | 2000-07-09 13:01:59 +0000 |
| commit | b474779f4696a53df0b5163e6747ac4c26663a9d (patch) | |
| tree | c83a7eea326798953af3b44c0820ddd759b62554 | |
| parent | e63b255aa657557d6393bd0b998aaae35b47cad4 (diff) | |
Notes
| -rw-r--r-- | sys/netinet/tcp_input.c | 4 | ||||
| -rw-r--r-- | sys/netinet/tcp_reass.c | 4 |
2 files changed, 6 insertions, 2 deletions
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index 9cdff6a78bcd8..427e6c739445f 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -2329,8 +2329,10 @@ tcp_dooptions(tp, cp, cnt, th, to) if (opt == TCPOPT_NOP) optlen = 1; else { + if (cnt < 2) + break; optlen = cp[1]; - if (optlen <= 0) + if (optlen < 2 || optlen > cnt) break; } switch (opt) { diff --git a/sys/netinet/tcp_reass.c b/sys/netinet/tcp_reass.c index 9cdff6a78bcd8..427e6c739445f 100644 --- a/sys/netinet/tcp_reass.c +++ b/sys/netinet/tcp_reass.c @@ -2329,8 +2329,10 @@ tcp_dooptions(tp, cp, cnt, th, to) if (opt == TCPOPT_NOP) optlen = 1; else { + if (cnt < 2) + break; optlen = cp[1]; - if (optlen <= 0) + if (optlen < 2 || optlen > cnt) break; } switch (opt) { |