From 463c1212c2ca6c158c1e53385ca7626be27acdae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=B6ren=20Tempel?= Date: Mon, 16 Sep 2019 17:48:41 +0200 Subject: [PATCH] gnrc_tcp: Always ensure that option->length doesn't exceed opt_left --- sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c b/sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c index 340b92abb9..aaca03fa6f 100644 --- a/sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c +++ b/sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c @@ -51,7 +51,7 @@ int _option_parse(gnrc_tcp_tcb_t *tcb, tcp_hdr_t *hdr) continue; case TCP_OPTION_KIND_MSS: - if (option->length != TCP_OPTION_LENGTH_MSS) { + if (option->length > opt_left || option->length != TCP_OPTION_LENGTH_MSS) { DEBUG("gnrc_tcp_option.c : _option_parse() : invalid MSS Option length.\n"); return -1; }