diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-05-05 23:25:24 +0300 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-05-05 23:26:09 +0300 |
| commit | 5e024c325406470d1165a09c6feaf8ec897936be (patch) | |
| tree | f0c342e641912b5e6e41e0965971f1410bc2a44c /net | |
| parent | 7072a355ba191c08b0579f0f66e3eba0e28bf818 (diff) | |
| download | linux-5e024c325406470d1165a09c6feaf8ec897936be.tar.xz | |
netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check
Do not assume that the tcph->doff field is correct when parsing for TCP
options, skb_header_pointer() might fail to fetch these bits.
Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nfnetlink_osf.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c index e8f8875c6884..0fa2e2030427 100644 --- a/net/netfilter/nfnetlink_osf.c +++ b/net/netfilter/nfnetlink_osf.c @@ -186,6 +186,8 @@ static const struct tcphdr *nf_osf_hdr_ctx_init(struct nf_osf_hdr_ctx *ctx, ctx->optp = skb_header_pointer(skb, ip_hdrlen(skb) + sizeof(struct tcphdr), ctx->optsize, opts); + if (!ctx->optp) + return NULL; } return tcp; |