From b5c54d9687c676b3238f0f7a59e3ba5e88fd15e2 Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Fri, 26 Jun 2026 22:06:05 +0000
Subject: [PATCH] Check for tcp th_off < 5

---
 osscan2.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/osscan2.cc b/osscan2.cc
index 30ec7b636..03e0617ff 100644
--- a/osscan2.cc
+++ b/osscan2.cc
@@ -1908,7 +1908,8 @@ bool HostOsScan::processResp(HostOsScanStats *hss, const u8 *pkt, unsigned int l
     if (len < sizeof(tcp))
       return false;
     memcpy(&tcp, l4pkt, sizeof(tcp));
-    if (len < (unsigned int)(4 * tcp.th_off))
+    const unsigned int tcphlen = 4 * tcp.th_off;
+    if (tcphlen < sizeof(tcp) || len < tcphlen)
       return false;
     testno = ntohs(tcp.th_dport) - tcpPortBase;