renet/renet
renet
/
renet
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix a crash parsing malformed TCP options. 

Found via cargo-fuzz.
This commit is contained in:
whitequark 2017-06-24 11:25:48 +00:00
parent c09e96a657
commit 6842d7013d
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/wire/tcp.rs
View File

@ -514,8 +514,7 @@ impl<'a> TcpOption<'a> {
}
kind => {
length = *buffer.get(1).ok_or(Error::Truncated)? as usize;
if buffer.len() < length { return Err(Error::Truncated) }
let data = &buffer[2..length];
let data = buffer.get(2..length).ok_or(Error::Truncated)?;
match (kind, length) {
(field::OPT_END, _) |
(field::OPT_NOP, _) =>
@ -931,6 +930,8 @@ mod test {
Err(Error::Truncated));
assert_eq!(TcpOption::parse(&[0xc, 0x05, 0x01, 0x02]),
Err(Error::Truncated));
assert_eq!(TcpOption::parse(&[0xc, 0x01]),
Err(Error::Truncated));
assert_eq!(TcpOption::parse(&[0x2, 0x02]),
Err(Error::Malformed));
assert_eq!(TcpOption::parse(&[0x3, 0x02]),