Author: tuexen
Date: Tue Feb 5 10:13:51 2019
New Revision: 343769
URL: https://svnweb.freebsd.org/changeset/base/343769
Log:
Fix an off-by-one error in the input validation of the SCTP_RESET_STREAMS
socketoption.
This was found by running syzkaller.
MFC after: 3 days
Modified:
head/sys/netinet/sctp_usrreq.c
Modified: head/sys/netinet/sctp_usrreq.c
==============================================================================
--- head/sys/netinet/sctp_usrreq.c Tue Feb 5 08:15:19 2019
(r343768)
+++ head/sys/netinet/sctp_usrreq.c Tue Feb 5 10:13:51 2019
(r343769)
@@ -4654,13 +4654,13 @@ sctp_setopt(struct socket *so, int optname, void *optv
}
for (i = 0; i < strrst->srs_number_streams; i++) {
if ((send_in) &&
- (strrst->srs_stream_list[i] >
stcb->asoc.streamincnt)) {
+ (strrst->srs_stream_list[i] >=
stcb->asoc.streamincnt)) {
SCTP_LTRACE_ERR_RET(inp, NULL, NULL,
SCTP_FROM_SCTP_USRREQ, EINVAL);
error = EINVAL;
break;
}
if ((send_out) &&
- (strrst->srs_stream_list[i] >
stcb->asoc.streamoutcnt)) {
+ (strrst->srs_stream_list[i] >=
stcb->asoc.streamoutcnt)) {
SCTP_LTRACE_ERR_RET(inp, NULL, NULL,
SCTP_FROM_SCTP_USRREQ, EINVAL);
error = EINVAL;
break;
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
