From 66e5f7230f7111c7e3d3ea9f19b6557fd38835ed Mon Sep 17 00:00:00 2001 From: Martine Lenders Date: Thu, 3 Oct 2019 18:30:40 +0200 Subject: [PATCH] gnrc_tcp: check if option has valid length set --- sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c b/sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c index 5226e34588..ff4cda44f6 100644 --- a/sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c +++ b/sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c @@ -69,7 +69,8 @@ int _option_parse(gnrc_tcp_tcb_t *tcb, tcp_hdr_t *hdr) } } - if (opt_left < TCP_OPTION_LENGTH_MIN || option->length > opt_left) { + if ((opt_left < TCP_OPTION_LENGTH_MIN) || (option->length > opt_left) || + (option->length < TCP_OPTION_LENGTH_MIN)) { DEBUG("gnrc_tcp_option.c : _option_parse() : Invalid option. Drop Packet.\n"); return -1; }