Re: [PATCH v2] netfilter: guard option walkers against 1-byte tail reads

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sat, Mar 07, 2026 at 08:45:52PM +0200, David Dull wrote:
> When the last byte of options is a non-single-byte option kind, walkers
> that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
> of the option area.
> 
> Add an explicit i == optlen - 1 check before dereferencing op[i + 1]
> in xt_tcpudp and xt_dccp option walkers.
> 
> Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
> Cc: fw@strlen.de
> Cc: stable@vger.kernel.org
> Signed-off-by: David Dull <monderasdor@gmail.com>
> ---
>  net/netfilter/xt_dccp.c   | 4 ++--
>  net/netfilter/xt_tcpudp.c | 6 ++++--
>  2 files changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
> index e5a13ecbe6..037ab93e25 100644
> --- a/net/netfilter/xt_dccp.c
> +++ b/net/netfilter/xt_dccp.c
> @@ -62,10 +62,10 @@ dccp_find_option(u_int8_t option,
>  			return true;
>  		}
>  
> -		if (op[i] < 2)
> +		if (op[i] < 2 || i == optlen - 1)
>  			i++;
>  		else
> -			i += op[i+1]?:1;
> +			i += op[i + 1] ? : 1;
>  	}

To improve this area, I'd suggest:

		if (op[i] < 2) {
 			i++;
                        continue;
                }

                if (i + 1 >= optlen)
                        break;

		i += op[i + 1] ? : 1;
 	}