RIOT-OS/RIOT
RIOT-OS/RIOT
1
0
Fork 0
mirror of https://github.com/RIOT-OS/RIOT.git synced 2024-12-29 04:50:03 +01:00
Code Releases Activity

gnrc_tcp: Always ensure that option->length doesn't exceed opt_left

Browse Source
This commit is contained in:
Sören Tempel 2019-09-16 17:48:41 +02:00
parent 0ae86d7775
commit 463c1212c2
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c
View File

@ -51,7 +51,7 @@ int _option_parse(gnrc_tcp_tcb_t *tcb, tcp_hdr_t *hdr)
continue;
case TCP_OPTION_KIND_MSS:
if (option->length != TCP_OPTION_LENGTH_MSS) {
if (option->length > opt_left || option->length != TCP_OPTION_LENGTH_MSS) {
DEBUG("gnrc_tcp_option.c : _option_parse() : invalid MSS Option length.\n");
return -1;
}