Fix a crash parsing a truncated TCP packet with options.

Found via cargo-fuzz.

Author: whitequark

src/wire/tcp.rs

@@ -123,7 +123,12 @@ impl<T: AsRef<[u8]>> Packet<T> {
         if len < field::URGENT.end {
             Err(Error::Truncated)
         } else {
-            Ok(())
+            let header_len = self.header_len() as usize;
+            if len < header_len {
+                Err(Error::Truncated)
+            } else {
+                Ok(())
+            }
         }
     }
 
@@ -862,6 +867,12 @@ mod test {
         assert_eq!(&packet.into_inner()[..], &PACKET_BYTES[..]);
     }
 
+    #[test]
+    fn test_truncated() {
+        let packet = Packet::new(&PACKET_BYTES[..23]);
+        assert_eq!(packet.check_len(), Err(Error::Truncated));
+    }
+
     static SYN_PACKET_BYTES: [u8; 24] =
         [0xbf, 0x00, 0x00, 0x50,
          0x01, 0x23, 0x45, 0x67,