diff options
| author | yujuan.qi <yujuan.qi@mediatek.com> | 2017-07-31 11:23:01 +0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2019-02-11 17:53:21 +0000 |
| commit | f062bca875e2062312e5893120f5fd0692b2117a (patch) | |
| tree | 77738f3ea863945307f8c5e07b75467c2f7bf184 /net/ipv4 | |
| parent | 89aa01ccfc7c651335fadd9ffb4728dc8cd29925 (diff) | |
| download | linux-stable-f062bca875e2062312e5893120f5fd0692b2117a.tar.gz linux-stable-f062bca875e2062312e5893120f5fd0692b2117a.tar.bz2 linux-stable-f062bca875e2062312e5893120f5fd0692b2117a.zip | |
Cipso: cipso_v4_optptr enter infinite loop
commit 40413955ee265a5e42f710940ec78f5450d49149 upstream.
in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue
Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/ipv4')
| -rw-r--r-- | net/ipv4/cipso_ipv4.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c index e3acdc29db61..2bb750617c08 100644 --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c @@ -1606,9 +1606,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb) int taglen; for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) { - if (optptr[0] == IPOPT_CIPSO) + switch (optptr[0]) { + case IPOPT_CIPSO: return optptr; - taglen = optptr[1]; + case IPOPT_END: + return NULL; + case IPOPT_NOOP: + taglen = 1; + break; + default: + taglen = optptr[1]; + } optlen -= taglen; optptr += taglen; } |