Log Message: |
The length field of the option header does not count the size of the option
header itself. This causes a problem when the length is zero, the count is
then incremented by zero, which causes an infinite loop.
In addition there are pointer/offset mistakes in the handling of IPv4
options.
Obtained from: FreeBSD
|