Commit 40413955 authored Jul 31, 2017 by yujuan.qi Committed by David S. Miller Aug 01, 2017

Cipso: cipso_v4_optptr enter infinite loop

in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.

Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue

Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent fdaa419b

net/ipv4/cipso_ipv4.c

+10 −2

Original line number	Diff line number	Diff line
		@@ -1523,9 +1523,17 @@ unsigned char cipso_v4_optptr(const struct sk_buff skb)
		int taglen;

		for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
		if (optptr[0] == IPOPT_CIPSO)
		switch (optptr[0]) {
		case IPOPT_CIPSO:
		return optptr;
		case IPOPT_END:
		return NULL;
		case IPOPT_NOOP:
		taglen = 1;
		break;
		default:
		taglen = optptr[1];
		}
		optlen -= taglen;
		optptr += taglen;
		}