TCP EOL option pad_len is in bits, not bytes

[Klaus Warnke]

Hello,

there is a conformance issue in d_tcp_parse_eol_dyn()
The pad_len is transmitted, for what reason ever, in bits, not bytes.
See rfc:

// nbits is bound to the remaining length (in bits) of TCP
// options, including the EOL type byte.
tcp_opt_eol(nbits)
{
...
  COMPRESSED eol_list_item {
    pad_len =:= compressed_value(8, nbits-8) [ 8 ];
  }
...
}

Therefore I suggest this change:

diff --git a/src/decomp/d_tcp_opts_list.c b/src/decomp/d_tcp_opts_list.c
index 0fef714..0bf92f6 100644
--- a/src/decomp/d_tcp_opts_list.c
+++ b/src/decomp/d_tcp_opts_list.c
@@ -776,7 +776,15 @@ static int d_tcp_parse_eol_dyn(const struct rohc_decomp_ctxt *const context,
                    "required for EOL option", data_len, eol_dyn_len);
   goto error;
  }
- eol_uncomp_len = data[0] + 1;
+ if ((data[0] % 8) != 0)
+ {
+ rohc_decomp_warn(context, "malformed TCP dynamic part: malformed TCP option "
+ "items: TCP EOL option has malformed pad_len %u bits, "
+ "not divisible by 8 (uncompleted byte)", data[0]);
+ goto error;
+ }
+
+ eol_uncomp_len = (data[0] / 8) + 1;
  if(eol_uncomp_len > max_opt_len)
  {
   rohc_decomp_warn(context, "malformed TCP dynamic part: malformed TCP option "

A test could be ipv4/tcp/afl11.
The second packet contains an EOL option.

Best,
Klaus Warnke

[Didier Barvaux (didier-barvaux)]

You're right. My bad :-/

Your patch looks good. I'll add the compressor part, then push the fix in master for the 2.0.0 release.

Thank you for the report!

[Didier Barvaux (didier-barvaux)]

Fix pushed on master.