🐞 fix(l2tp偏移长度计算时,增加长度判断):
This commit is contained in:
@@ -389,6 +389,10 @@ static int __mjl_parse_l2tpv2_hdr(const struct l2tp_hdr_v2 *pl2tphdrv2, struct l
|
|||||||
|
|
||||||
if(pl2tphdrv2->offset_present){
|
if(pl2tphdrv2->offset_present){
|
||||||
offset_size = ntohs(*((unsigned short *)ptr));
|
offset_size = ntohs(*((unsigned short *)ptr));
|
||||||
|
if(offset_size > 1460)
|
||||||
|
{
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
ptr += sizeof(short); /* 2 byte fix len offset size */
|
ptr += sizeof(short); /* 2 byte fix len offset size */
|
||||||
ptr += offset_size; /* var bytes offset value length */
|
ptr += offset_size; /* var bytes offset value length */
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user