Author: tuexen
Date: Wed Oct 8 15:30:59 2014
New Revision: 272751
URL: https://svnweb.freebsd.org/changeset/base/272751
Log:
Ensure that the list of streams sent in a stream reset parameter fits
in an mbuf-cluster.
Thanks to Peter Bostroem for drawing my attention to this part of the code.
Modified:
head/sys/netinet/sctp_output.c
head/sys/netinet/sctp_output.h
Modified: head/sys/netinet/sctp_output.c
==============================================================================
--- head/sys/netinet/sctp_output.c Wed Oct 8 15:29:49 2014
(r272750)
+++ head/sys/netinet/sctp_output.c Wed Oct 8 15:30:59 2014
(r272751)
@@ -11846,7 +11846,7 @@ sctp_add_an_in_stream(struct sctp_tmit_c
int
sctp_send_str_reset_req(struct sctp_tcb *stcb,
- int number_entries, uint16_t * list,
+ uint16_t number_entries, uint16_t * list,
uint8_t send_out_req,
uint8_t send_in_req,
uint8_t send_tsn_req,
@@ -11879,6 +11879,14 @@ sctp_send_str_reset_req(struct sctp_tcb
SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT,
EINVAL);
return (EINVAL);
}
+ if (number_entries > (MCLBYTES -
+ SCTP_MIN_OVERHEAD -
+ sizeof(struct sctp_chunkhdr) -
+ sizeof(struct sctp_stream_reset_out_request)) /
+ sizeof(uint16_t)) {
+ SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT,
ENOMEM);
+ return (ENOMEM);
+ }
sctp_alloc_a_chunk(stcb, chk);
if (chk == NULL) {
SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT,
ENOMEM);
Modified: head/sys/netinet/sctp_output.h
==============================================================================
--- head/sys/netinet/sctp_output.h Wed Oct 8 15:29:49 2014
(r272750)
+++ head/sys/netinet/sctp_output.h Wed Oct 8 15:30:59 2014
(r272751)
@@ -181,8 +181,8 @@ sctp_add_stream_reset_result_tsn(struct
uint32_t, uint32_t, uint32_t, uint32_t);
int
-sctp_send_str_reset_req(struct sctp_tcb *, int, uint16_t *, uint8_t, uint8_t,
- uint8_t, uint8_t, uint16_t, uint16_t, uint8_t);
+sctp_send_str_reset_req(struct sctp_tcb *, uint16_t, uint16_t *, uint8_t,
+ uint8_t, uint8_t, uint8_t, uint16_t, uint16_t, uint8_t);
void
sctp_send_abort(struct mbuf *, int, struct sockaddr *, struct sockaddr *,
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
