Re: [PATCH v3] netfilter: guard option walkers against 1-byte tail reads

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Mar 08, 2026 at 05:52:11PM +0200, David Dull wrote:
> When the last byte of options is a non-single-byte option kind, walkers
> that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
> of the option area.
> 
> Handle single-byte options first, then check that a length byte is still
> available before reading op[i + 1] in xt_tcpudp and xt_dccp option
> walkers.
> 
> Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Dull <monderasdor@gmail.com>
> ---
>  net/netfilter/xt_dccp.c   | 8 ++++++--
>  net/netfilter/xt_tcpudp.c | 8 ++++++--
>  2 files changed, 12 insertions(+), 4 deletions(-)
> 
> diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
> index e5a13ecbe6..7f9e2d5c1b 100644
> --- a/net/netfilter/xt_dccp.c
> +++ b/net/netfilter/xt_dccp.c
> @@ -62,10 +62,14 @@ dccp_find_option(u_int8_t option,
>  			return true;
>  		}
>  
> -		if (op[i] < 2 || i == optlen - 1)
> +		if (op[i] < 2) {
>  			i++;
> -		else
> +			continue;
> +		}
> +
> +		if (i + 1 >= optlen)
> +			break;
> +
>  			i += op[i + 1] ? : 1;

This indent is wrong, I posted this patch:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260308112510.2958551-1-pablo@netfilter.org/