: On Mon, 8 Apr 1996, Darren Reed wrote:
: >
: > Consider the case when the packet has an option length of 0 for an
: > option which falls into the "default" case but the packet claims to
: > have (say) 8 bytes of IP options.
: Right. Does the lockup go away if you add a test for zero optlen in
: ip_options.c, line 277. Pseudo-patch:
: continue;
: }
: optlen = optptr[1];
: - if (l<2 || optlen>l)
: + if (l<2 || optlen>l || !optlen)
: {
: pp_ptr = optptr;
Seems, I meaned really:
: - if (l<2 || optlen>l)
: + if (optlen<2 || optlen>l)
Alexey Kuznetsov.