Author: tuexen
Date: Wed Aug 14 21:51:32 2013
New Revision: 254338
URL: http://svnweb.freebsd.org/changeset/base/254338

Log:
  Don't send uninitialized memory (two instances of 4 bytes) in
  every cookie on the wire. This bug was reported in
  https://bugzilla.mozilla.org/show_bug.cgi?id=905080
  
  MFC after: 3 days

Modified:
  head/sys/netinet/sctp_output.c

Modified: head/sys/netinet/sctp_output.c
==============================================================================
--- head/sys/netinet/sctp_output.c      Wed Aug 14 21:11:26 2013        
(r254337)
+++ head/sys/netinet/sctp_output.c      Wed Aug 14 21:51:32 2013        
(r254338)
@@ -5406,6 +5406,14 @@ do_a_abort:
        }
        SCTP_BUF_LEN(m) = sizeof(struct sctp_init_chunk);
 
+       /*
+        * We might not overwrite the identification[] completely and on
+        * some platforms time_entered will contain some padding. Therefore
+        * zero out the cookie to avoid putting uninitialized memory on the
+        * wire.
+        */
+       memset(&stc, 0, sizeof(struct sctp_state_cookie));
+
        /* the time I built cookie */
        (void)SCTP_GETTIME_TIMEVAL(&stc.time_entered);
 
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"

Reply via email to