D22749.id.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D22749.id.diff
View Options

	Index: sys/netpfil/ipfw/ip_fw2.c
	===================================================================
	--- sys/netpfil/ipfw/ip_fw2.c
	+++ sys/netpfil/ipfw/ip_fw2.c
	@@ -344,8 +344,10 @@
	if (opt == TCPOPT_NOP)
	optlen = 1;
	else {
	+ if (x < 2)
	+ break;
	optlen = cp[1];
	- if (optlen <= 0)
	+ if (optlen < 2 \|\| optlen > x)
	break;
	}

	@@ -354,22 +356,31 @@
	break;

	case TCPOPT_MAXSEG:
	+ if (optlen != TCPOLEN_MAXSEG)
	+ break;
	bits \|= IP_FW_TCPOPT_MSS;
	if (mss != NULL)
	*mss = be16dec(cp + 2);
	break;

	case TCPOPT_WINDOW:
	- bits \|= IP_FW_TCPOPT_WINDOW;
	+ if (optlen == TCPOLEN_WINDOW)
	+ bits \|= IP_FW_TCPOPT_WINDOW;
	break;

	case TCPOPT_SACK_PERMITTED:
	+ if (optlen == TCPOLEN_SACK_PERMITTED)
	+ bits \|= IP_FW_TCPOPT_SACK;
	+ break;
	+
	case TCPOPT_SACK:
	- bits \|= IP_FW_TCPOPT_SACK;
	+ if (optlen > 2 && (optlen - 2) % TCPOLEN_SACK == 0)
	+ bits \|= IP_FW_TCPOPT_SACK;
	break;

	case TCPOPT_TIMESTAMP:
	- bits \|= IP_FW_TCPOPT_TS;
	+ if (optlen == TCPOLEN_TIMESTAMP)
	+ bits \|= IP_FW_TCPOPT_TS;
	break;
	}
	}