From 0cd0b77e005a556307376786310b174bf58cf451 Mon Sep 17 00:00:00 2001 From: Gerrit Renker Date: Sat, 23 Aug 2008 13:28:27 +0200 Subject: [PATCH] --- yaml --- r: 111238 b: refs/heads/master c: 1efa6bbac876318ebf6f3a757f18e7d9ebe02dd0 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/net/dccp/options.c | 10 ++++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/[refs] b/[refs] index 813ed77eeb6f..ad15e0d82814 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 33c449675c0e371edd35b3bd7ce8a14451ff2f0b +refs/heads/master: 1efa6bbac876318ebf6f3a757f18e7d9ebe02dd0 diff --git a/trunk/net/dccp/options.c b/trunk/net/dccp/options.c index dc7c158a2f4b..4284f0856047 100644 --- a/trunk/net/dccp/options.c +++ b/trunk/net/dccp/options.c @@ -81,11 +81,11 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, /* Check if this isn't a single byte option */ if (opt > DCCPO_MAX_RESERVED) { if (opt_ptr == opt_end) - goto out_invalid_option; + goto out_nonsensical_length; len = *opt_ptr++; - if (len < 3) - goto out_invalid_option; + if (len < 2) + goto out_nonsensical_length; /* * Remove the type and len fields, leaving * just the value size @@ -95,7 +95,7 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, opt_ptr += len; if (opt_ptr > opt_end) - goto out_invalid_option; + goto out_nonsensical_length; } /* @@ -283,6 +283,8 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, if (mandatory) goto out_invalid_option; +out_nonsensical_length: + /* RFC 4340, 5.8: ignore option and all remaining option space */ return 0; out_invalid_option: