[GNUnet-SVN] r19447 - gnunet/src/exit

[gnunet]

Author: grothoff
Date: 2012-01-26 17:11:16 +0100 (Thu, 26 Jan 2012)
New Revision: 19447

Modified:
   gnunet/src/exit/gnunet-daemon-exit.c
Log:
-check tcp off value

Modified: gnunet/src/exit/gnunet-daemon-exit.c
===================================================================
--- gnunet/src/exit/gnunet-daemon-exit.c        2012-01-26 15:46:01 UTC (rev 
19446)
+++ gnunet/src/exit/gnunet-daemon-exit.c        2012-01-26 16:11:16 UTC (rev 
19447)
@@ -1573,6 +1573,11 @@
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
   }
+  if (start->tcp_header.off * 4 < sizeof (struct GNUNET_TUN_TcpHeader))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
   GNUNET_break_op (ntohl (start->reserved) == 0);
   /* setup fresh connection */
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -1649,6 +1654,11 @@
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
   }
+  if (start->tcp_header.off * 4 < sizeof (struct GNUNET_TUN_TcpHeader))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
   af = (int) ntohl (start->af);
   state->ri.remote_address.af = af;
   switch (af)
@@ -1699,7 +1709,6 @@
                           buf, sizeof (buf)),
                (unsigned int) ntohs (start->tcp_header.dpt));  
   }
-
   state->ri.remote_address.proto = IPPROTO_TCP;
   state->ri.remote_address.port = ntohs (start->tcp_header.dpt);
   setup_state_record (state);
@@ -1757,6 +1766,11 @@
                              1, GNUNET_NO);
     return GNUNET_SYSERR;
   }
+  if (data->tcp_header.off * 4 < sizeof (struct GNUNET_TUN_TcpHeader))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
   GNUNET_break_op (ntohl (data->reserved) == 0);
   {
     char buf[INET6_ADDRSTRLEN];