decode/ipv4: fix ts opt flags decoding

Field is at data+1 offset, not +3. Also makes sure we always stay
within checked data bounds.

Reported-by: Sirko Höer -- Code Intelligence for DCSO.
Bug #3176.

diff --git a/src/decode-ipv4.c b/src/decode-ipv4.c
index 8a0bee951cca2091eae1743cfd4224d150e7dc15..0832b9de5672e1ff16d9180cf49802ab31f5a3e5 100644 (file)
--- a/src/decode-ipv4.c
+++ b/src/decode-ipv4.c
@@ -159,7 +159,7 @@ static int IPV4OptValidateTimestamp(Packet *p, const IPV4Opt *o)
         ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
         return -1;
     }
-    flag = *(o->data + 3) & 0x00ff;
+    flag = *(o->data + 1) & 0x0f;
 
     /* A flag of 1|3 means we have both the ip+ts in each record */
     rec_size = ((flag == 1) || (flag == 3)) ? 8 : 4;