diff options
| author | tuexen <tuexen@FreeBSD.org> | 2012-04-19 12:43:19 +0000 |
|---|---|---|
| committer | tuexen <tuexen@FreeBSD.org> | 2012-04-19 12:43:19 +0000 |
| commit | 9035fb1c4c6e1bb36fce152aa86c05ccac23239a (patch) | |
| tree | 9c13f406a5f9af38a9f4b49f9732347046ec6112 /sys/netinet/sctp_indata.c | |
| parent | fdb56713f24f9603c0b1d9d04f819a450c247a91 (diff) | |
| download | FreeBSD-src-9035fb1c4c6e1bb36fce152aa86c05ccac23239a.zip FreeBSD-src-9035fb1c4c6e1bb36fce152aa86c05ccac23239a.tar.gz | |
Fix a bug where we copy out more data from a mbuf chain that are
actually in it. This happens when SCTP receives an unknown chunk, which
requires the sending of an ERROR chunk, and there is no final padding but
the chunk is not 4-byte aligned.
Reported by yueting via rwatson@
MFC after: 3 days
Diffstat (limited to 'sys/netinet/sctp_indata.c')
| -rw-r--r-- | sys/netinet/sctp_indata.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/sys/netinet/sctp_indata.c b/sys/netinet/sctp_indata.c index 54372ac..d7b9d9c 100644 --- a/sys/netinet/sctp_indata.c +++ b/sys/netinet/sctp_indata.c @@ -2746,11 +2746,13 @@ sctp_process_data(struct mbuf **mm, int iphlen, int *offset, int length, phd->param_length = htons(chk_length + sizeof(*phd)); SCTP_BUF_LEN(merr) = sizeof(*phd); - SCTP_BUF_NEXT(merr) = SCTP_M_COPYM(m, *offset, - SCTP_SIZE32(chk_length), - M_DONTWAIT); + SCTP_BUF_NEXT(merr) = SCTP_M_COPYM(m, *offset, chk_length, M_DONTWAIT); if (SCTP_BUF_NEXT(merr)) { - sctp_queue_op_err(stcb, merr); + if (sctp_pad_lastmbuf(SCTP_BUF_NEXT(merr), SCTP_SIZE32(chk_length) - chk_length, NULL)) { + sctp_m_freem(merr); + } else { + sctp_queue_op_err(stcb, merr); + } } else { sctp_m_freem(merr); } |
