Fix a crash parsing malformed TCP options.

Found via cargo-fuzz.
smoltcp-rs · Jun 24, 2017 · 3f43be8 · 3f43be8
1 parent 2582d15
commit 3f43be8
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/wire/tcp.rs b/src/wire/tcp.rs
@@ -514,8 +514,7 @@ impl<'a> TcpOption<'a> {
             }
             kind => {
                 length = *buffer.get(1).ok_or(Error::Truncated)? as usize;
-                if buffer.len() < length { return Err(Error::Truncated) }
-                let data = &buffer[2..length];
+                let data = buffer.get(2..length).ok_or(Error::Truncated)?;
                 match (kind, length) {
                     (field::OPT_END, _) |
                     (field::OPT_NOP, _) =>
@@ -931,6 +930,8 @@ mod test {
                    Err(Error::Truncated));
         assert_eq!(TcpOption::parse(&[0xc, 0x05, 0x01, 0x02]),
                    Err(Error::Truncated));
+        assert_eq!(TcpOption::parse(&[0xc, 0x01]),
+                   Err(Error::Truncated));
         assert_eq!(TcpOption::parse(&[0x2, 0x02]),
                    Err(Error::Malformed));
         assert_eq!(TcpOption::parse(&[0x3, 0x02]),