Messages in this thread | | | Date | Wed, 23 Sep 1998 01:38:32 +0300 ( ) | From | Koxaras Aris <> | Subject | tcp options bug? |
| |
I think there's a (harmless) bug in net/ipv4/tcp_input.c, in function tcp_options(). One can send "TCP_NOP,TCP_NOP,TCPOPT_MSS,4" as TCP options, forcing the kernel to read 2 more bytes after the end of the tcp packet options. This happens because tcp_options() does NOT check if length <= opsize. It only checks if opsize<=2.
Greetings, mastoras
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |