--- net/dccp/options.c

+++ net/dccp/options.c

@@ -131,6 +131,8 @@ int dccp_parse_options(struct sock *sk,

case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R:

if (pkt_type == DCCP_PKT_DATA) /* RFC 4340, 6 */

break;

+ if (len == 0)

+ goto out_invalid_option;

rc = dccp_feat_parse_options(sk, dreq, mandatory, opt,

*value, value + 1, len - 1);

if (rc)