Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

netfilter: xt_TCPOPTSTRIP: fix possible off by one access

Browse source 
Fix a possible off by one access since optlen()
touches opt[offset+1] unsafely when i == tcp_hdrlen(skb) - 1.

This patch replaces tcp_hdrlen() by the local variable tcp_hdrlen
that stores the TCP header length, to save some cycles.

Reported-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2013-07-25 10:46:46 +02:00
parent 71ffe9c77d
commit a206bcb3b0
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
net/netfilter/xt_TCPOPTSTRIP.c
View file

@ -38,7 +38,7 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
struct tcphdr *tcph; struct tcphdr *tcph;
u_int16_t n, o; u_int16_t n, o;
u_int8_t *opt; u_int8_t *opt;
int len; int len, tcp_hdrlen;
/* This is a fragment, no TCP header is available */ /* This is a fragment, no TCP header is available */
if (par->fragoff != 0) if (par->fragoff != 0)
@ -52,7 +52,9 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
return NF_DROP; return NF_DROP;
tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff); tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
if (tcph->doff * 4 > len) tcp_hdrlen = tcph->doff * 4;
if (len < tcp_hdrlen)
return NF_DROP; return NF_DROP;
opt = (u_int8_t *)tcph; opt = (u_int8_t *)tcph;
@ -61,10 +63,10 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
* Walk through all TCP options - if we find some option to remove, * Walk through all TCP options - if we find some option to remove,
* set all octets to %TCPOPT_NOP and adjust checksum. * set all octets to %TCPOPT_NOP and adjust checksum.
*/ */
for (i = sizeof(struct tcphdr); i < tcp_hdrlen(skb); i += optl) { for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {
optl = optlen(opt, i); optl = optlen(opt, i);
if (i + optl > tcp_hdrlen(skb)) if (i + optl > tcp_hdrlen)
break; break;
if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i])) if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))