tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
/* Header cannot be larger than the packet */
- if (tcplen < tcph->doff*4)
+ if (tcplen < tcph->doff*4 || tcph->doff*4 < sizeof(struct tcphdr))
return -1;
if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
if (tcplen > tcph->doff*4)
return 0;
+ /* tcph->doff has 4 bits, do not wrap it to 0 */
+ if (tcph->doff >= 15)
+ return 0;
+
/*
* MSS Option not found ?! add it..
*/