lkml.org 
[lkml]   [1996]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Frozen linux 1.3.84
Date
According to Linus Torvalds:
> > Consider the case when the packet has an option length of 0 for an
> > option which falls into the "default" case but the packet claims to
> > have (say) 8 bytes of IP options.
>
> Right. Does the lockup go away if you add a test for zero optlen in
> ip_options.c, line 277. Pseudo-patch:
>
> continue;
> }
> optlen = optptr[1];
> - if (l<2 || optlen>l)
> + if (l<2 || optlen>l || !optlen)
> {
> pp_ptr = optptr;
> break;
>
> (or something to that effect..) Does that fix it?
>
> Linus

In fact, value 1 is illegal for optlen as well. "optlen < 2" is
a better check.
(the option length includes the option byte and the length field itself)

Rob

--
+------------------------------------+--------------------------------------+
| Rob Janssen rob@knoware.nl | BBS: +31-302870036 (2300-0730 local) |
| AMPRnet: rob@pe1chl.ampr.org | AX.25 BBS: PE1CHL@PI8WNO.#UTR.NLD.EU |
+------------------------------------+--------------------------------------+


\
 
 \ /
  Last update: 2005-03-22 13:37    [W:0.048 / U:0.268 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site