riot-ci/RIOT
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

gnrc_tcp: check if option has valid length set

Browse Source
This commit is contained in:
Martine Lenders 2019-10-03 18:30:40 +02:00
parent e9e0001239
commit 66e5f7230f
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c
View File

@ -69,7 +69,8 @@ int _option_parse(gnrc_tcp_tcb_t *tcb, tcp_hdr_t *hdr)
}
}
if (opt_left < TCP_OPTION_LENGTH_MIN || option->length > opt_left) {
if ((opt_left < TCP_OPTION_LENGTH_MIN) || (option->length > opt_left) ||
(option->length < TCP_OPTION_LENGTH_MIN)) {
DEBUG("gnrc_tcp_option.c : _option_parse() : Invalid option. Drop Packet.\n");
return -1;
}