Pārlūkot izejas kodu

[tcp] Avoid potential NULL pointer dereference

Commit ea61075 ("[tcp] Add support for TCP window scaling") introduced
a potential NULL pointer dereference by referring to the connection's
send window scale before checking whether or not the connection is
known.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 12 gadus atpakaļ
vecāks
revīzija
55f52bb77a
1 mainītis faili ar 3 papildinājumiem un 1 dzēšanām
  1. 3
    1
      src/net/tcp.c

+ 3
- 1
src/net/tcp.c Parādīt failu

@@ -1155,6 +1155,7 @@ static int tcp_rx ( struct io_buffer *iobuf,
1155 1155
 	uint16_t csum;
1156 1156
 	uint32_t seq;
1157 1157
 	uint32_t ack;
1158
+	uint16_t raw_win;
1158 1159
 	uint32_t win;
1159 1160
 	unsigned int flags;
1160 1161
 	size_t len;
@@ -1195,7 +1196,7 @@ static int tcp_rx ( struct io_buffer *iobuf,
1195 1196
 	tcp = tcp_demux ( ntohs ( tcphdr->dest ) );
1196 1197
 	seq = ntohl ( tcphdr->seq );
1197 1198
 	ack = ntohl ( tcphdr->ack );
1198
-	win = ( ntohs ( tcphdr->win ) << tcp->snd_win_scale );
1199
+	raw_win = ntohs ( tcphdr->win );
1199 1200
 	flags = tcphdr->flags;
1200 1201
 	tcp_rx_opts ( tcp, ( ( ( void * ) tcphdr ) + sizeof ( *tcphdr ) ),
1201 1202
 		      ( hlen - sizeof ( *tcphdr ) ), &options );
@@ -1226,6 +1227,7 @@ static int tcp_rx ( struct io_buffer *iobuf,
1226 1227
 
1227 1228
 	/* Handle ACK, if present */
1228 1229
 	if ( flags & TCP_ACK ) {
1230
+		win = ( raw_win << tcp->snd_win_scale );
1229 1231
 		if ( ( rc = tcp_rx_ack ( tcp, ack, win ) ) != 0 ) {
1230 1232
 			tcp_xmit_reset ( tcp, st_src, tcphdr );
1231 1233
 			goto discard;

Notiek ielāde…
Atcelt
Saglabāt