netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr()

PATCH New Pablo Neira Ayuso 1 participant 1 message Jun 11, 2013

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Pablo Neira Ayuso

author maintainer

2013-06-11 00:14 UTC #0 lore raw

PATCH 1/1 netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr()

In (bc6bcb5 netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary), the use of tcp_hdr was introduced. However, we cannot assume that skb->transport_header is set for non-local packets.

Cc Florian Westphal <[email protected]>

Reported-by Phil Oester <[email protected]>

Signed-off-by Pablo Neira Ayuso <[email protected]>

---
 net/netfilter/xt_TCPOPTSTRIP.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

net/netfilter/xt_TCPOPTSTRIP.c +4 -2

index 1eb1a44..b68fa19 100644
@@ -48,11 +48,13 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
 		return NF_DROP;
 
 	len = skb->len - tcphoff;
-	if (len < (int)sizeof(struct tcphdr) ||
-	    tcp_hdr(skb)->doff * 4 > len)
+	if (len < (int)sizeof(struct tcphdr))
 		return NF_DROP;
 
 	tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
+	if (tcph->doff * 4 > len)
+		return NF_DROP;
+
 	opt  = (u_int8_t *)tcph;
 
 	/*

Signature · 1 line

1.7.10.4