tcp: no md5sig option size check bug

Dmitry Popov · davem330 · commit ba78e2ddca84 · 2010-08-07T20:24:28.000-07:00
tcp_parse_md5sig_option doesn't check md5sig option (TCPOPT_MD5SIG)
length, but tcp_v[46]_inbound_md5_hash assume that it's at least 16
bytes long.

Signed-off-by: Dmitry Popov &lt;dp@highloadlab.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
@@ -3930,7 +3930,7 @@ u8 *tcp_parse_md5sig_option(struct tcphdr *th)
 			if (opsize < 2 || opsize > length)
 				return NULL;
 			if (opcode == TCPOPT_MD5SIG)
-				return ptr;
+				return opsize == TCPOLEN_MD5SIG ? ptr : NULL;
 		}
 		ptr += opsize - 2;
 		length -= opsize;

Original file line number	Diff line number	Diff line change
`@@ -3930,7 +3930,7 @@ u8 tcp_parse_md5sig_option(struct tcphdr th)`
`3930`	`3930`	`if (opsize < 2 \|\| opsize > length)`
`3931`	`3931`	`return NULL;`
`3932`	`3932`	`if (opcode == TCPOPT_MD5SIG)`
`3933`		`- return ptr;`
	`3933`	`+ return opsize == TCPOLEN_MD5SIG ? ptr : NULL;`
`3934`	`3934`	`}`
`3935`	`3935`	`ptr += opsize - 2;`
`3936`	`3936`	`length -= opsize;`