diff options
| author |   Florin Coras <fcoras@cisco.com> | 2018-12-05 10:03:34 -0800 |
|---|---|---|
| committer |   Damjan Marion <dmarion@me.com> | 2018-12-07 15:08:58 +0000 |
| commit | b8dda5ffb6d357e085d4c2ca2d1f8e0828fc09c4 (patch) | |
| tree | 2b553c05155c675e976ab1febfc8901cf999e496 | |
| parent | e88865d7bc9cd45b044f8aeadf1916c38e0eb165 (diff) | |
tcp: fix length check
Change-Id: Iff75be238a231df88a37b61610c134e4a4770708
Signed-off-by: Florin Coras <fcoras@cisco.com>
| -rw-r--r-- | src/vnet/tcp/tcp_input.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/src/vnet/tcp/tcp_input.c b/src/vnet/tcp/tcp_input.c index e15ad73e2d1..4614772d008 100644 --- a/src/vnet/tcp/tcp_input.c +++ b/src/vnet/tcp/tcp_input.c @@ -3302,13 +3302,19 @@ tcp_input_lookup_buffer (vlib_buffer_t * b, u8 thread_index, u32 * error, if (is_ip4) { ip4_header_t *ip4 = vlib_buffer_get_current (b); + int ip_hdr_bytes = ip4_header_bytes (ip4); + if (PREDICT_FALSE (b->current_length < ip_hdr_bytes + sizeof (*tcp))) + { + *error = TCP_ERROR_LENGTH; + return 0; + } tcp = ip4_next_header (ip4); vnet_buffer (b)->tcp.hdr_offset = (u8 *) tcp - (u8 *) ip4; - n_advance_bytes = (ip4_header_bytes (ip4) + tcp_header_bytes (tcp)); + n_advance_bytes = (ip_hdr_bytes + tcp_header_bytes (tcp)); n_data_bytes = clib_net_to_host_u16 (ip4->length) - n_advance_bytes; /* Length check. Checksum computed by ipx_local no need to compute again */ - if (PREDICT_FALSE (n_advance_bytes < 0)) + if (PREDICT_FALSE (n_data_bytes < 0)) { *error = TCP_ERROR_LENGTH; return 0; @@ -3322,6 +3328,11 @@ tcp_input_lookup_buffer (vlib_buffer_t * b, u8 thread_index, u32 * error, else { ip6_header_t *ip6 = vlib_buffer_get_current (b); + if (PREDICT_FALSE (b->current_length < sizeof (*ip6) + sizeof (*tcp))) + { + *error = TCP_ERROR_LENGTH; + return 0; + } tcp = ip6_next_header (ip6); vnet_buffer (b)->tcp.hdr_offset = (u8 *) tcp - (u8 *) ip6; n_advance_bytes = tcp_header_bytes (tcp); @@ -3329,7 +3340,7 @@ tcp_input_lookup_buffer (vlib_buffer_t * b, u8 thread_index, u32 * error, - n_advance_bytes; n_advance_bytes += sizeof (ip6[0]); - if (PREDICT_FALSE (n_advance_bytes < 0)) + if (PREDICT_FALSE (n_data_bytes < 0)) { *error = TCP_ERROR_LENGTH; return 0; |