From df9ec637a8f97d436d045596fbd4fbda1bf72342 Mon Sep 17 00:00:00 2001 From: Gerrit Renker Date: Sat, 23 Aug 2008 13:28:27 +0200 Subject: [PATCH] --- yaml --- r: 111447 b: refs/heads/master c: faf61c3319ea336ed47acd6ca86faaaa3a8f4937 h: refs/heads/master i: 111445: 9774405c71a656dda039851f8e7d9f5f8869f882 111443: f7f9ffbc09ec4cdc49226e28cc984a9e21e7fa31 111439: f0a67750ed6dc31e3858676e95489115d104c653 v: v3 --- [refs] | 2 +- trunk/net/dccp/options.c | 10 ++++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/[refs] b/[refs] index 04b88f905a1a..78445d83d840 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: ba1a6c7bc0ff33e405f5156dc8f4145437255f1f +refs/heads/master: faf61c3319ea336ed47acd6ca86faaaa3a8f4937 diff --git a/trunk/net/dccp/options.c b/trunk/net/dccp/options.c index dc7c158a2f4b..4284f0856047 100644 --- a/trunk/net/dccp/options.c +++ b/trunk/net/dccp/options.c @@ -81,11 +81,11 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, /* Check if this isn't a single byte option */ if (opt > DCCPO_MAX_RESERVED) { if (opt_ptr == opt_end) - goto out_invalid_option; + goto out_nonsensical_length; len = *opt_ptr++; - if (len < 3) - goto out_invalid_option; + if (len < 2) + goto out_nonsensical_length; /* * Remove the type and len fields, leaving * just the value size @@ -95,7 +95,7 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, opt_ptr += len; if (opt_ptr > opt_end) - goto out_invalid_option; + goto out_nonsensical_length; } /* @@ -283,6 +283,8 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, if (mandatory) goto out_invalid_option; +out_nonsensical_length: + /* RFC 4340, 5.8: ignore option and all remaining option space */ return 0; out_invalid_option: