From cc7c6d2d18c28fcc6d085633dddd88402946140a Mon Sep 17 00:00:00 2001 From: "Sergio R. Caprile" Date: Tue, 14 Jul 2026 10:29:43 -0300 Subject: [PATCH] fix TCP opt parser --- mongoose.c | 6 +++--- src/net_builtin.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/mongoose.c b/mongoose.c index c9ff611d..3dcb3893 100644 --- a/mongoose.c +++ b/mongoose.c @@ -9415,9 +9415,9 @@ static bool handle_opt(struct connstate *s, struct tcp *tcp, bool ip6) { s->dmss = ip6 ? 1220 : 536; // assume default, RFC-9293 3.7.1 while (len > 0) { // RFC-9293 3.1 3.2 uint8_t kind = opts[0], optlen = 1; - if (kind != 1) { // No-Operation - if (kind == 0) break; // End of Option List - if (len < 2 || opts[1] == 0) return false; // Malformed options + if (kind != 1) { // No-Operation + if (kind == 0) break; // End of Option List + if (len < 2 || opts[1] == 0 || opts[1] > len) return false; // Malformed optlen = opts[1]; if (kind == 2 && optlen == 4) // set received MSS s->dmss = (uint16_t) (((uint16_t) opts[2] << 8) + opts[3]); diff --git a/src/net_builtin.c b/src/net_builtin.c index bca3fbd4..300e647f 100644 --- a/src/net_builtin.c +++ b/src/net_builtin.c @@ -1588,9 +1588,9 @@ static bool handle_opt(struct connstate *s, struct tcp *tcp, bool ip6) { s->dmss = ip6 ? 1220 : 536; // assume default, RFC-9293 3.7.1 while (len > 0) { // RFC-9293 3.1 3.2 uint8_t kind = opts[0], optlen = 1; - if (kind != 1) { // No-Operation - if (kind == 0) break; // End of Option List - if (len < 2 || opts[1] == 0) return false; // Malformed options + if (kind != 1) { // No-Operation + if (kind == 0) break; // End of Option List + if (len < 2 || opts[1] == 0 || opts[1] > len) return false; // Malformed optlen = opts[1]; if (kind == 2 && optlen == 4) // set received MSS s->dmss = (uint16_t) (((uint16_t) opts[2] << 8) + opts[3]);