Fix a off-by-one bug in zeroing out the mapping arrays.

Fix sctp_print_mapping_array().

MFC after: 1 week

2 files changed, 18 insertions, 33 deletions

diff --git a/sys/netinet/sctp_indata.c b/sys/netinet/sctp_indata.c
index 055b12b..53dcf8f 100644
--- a/sys/netinet/sctp_indata.c
+++ b/sys/netinet/sctp_indata.c
@@ -2275,8 +2275,7 @@ sctp_slide_mapping_arrays(struct sctp_tcb *stcb)
 	asoc->cumulative_tsn = asoc->mapping_array_base_tsn + (at - 1);
 
 	if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN) &&
-	    compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_nr_map, MAX_TSN)
-	    ) {
+	    compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_nr_map, MAX_TSN)) {
 #ifdef INVARIANTS
 		panic("huh, cumack 0x%x greater than high-tsn 0x%x in map",
 		    asoc->cumulative_tsn, asoc->highest_tsn_inside_map);
@@ -2378,7 +2377,7 @@ sctp_slide_mapping_arrays(struct sctp_tcb *stcb)
 				    asoc->nr_mapping_array[slide_from + ii];
 
 			}
-			for (ii = distance; ii <= asoc->mapping_array_size; ii++) {
+			for (ii = distance; ii < asoc->mapping_array_size; ii++) {
 				asoc->mapping_array[ii] = 0;
 				asoc->nr_mapping_array[ii] = 0;
 			}
diff --git a/sys/netinet/sctputil.c b/sys/netinet/sctputil.c
index bcc253d..0f2805f 100644
--- a/sys/netinet/sctputil.c
+++ b/sys/netinet/sctputil.c
@@ -1187,50 +1187,38 @@ sctp_init_asoc(struct sctp_inpcb *m, struct sctp_tcb *stcb,
 void
 sctp_print_mapping_array(struct sctp_association *asoc)
 {
-	int i, limit;
+	unsigned int i, limit;
 
-	printf("Mapping size:%d baseTSN:%8.8x cumAck:%8.8x highestTSN:%8.8x\n",
+	printf("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
 	    asoc->mapping_array_size,
 	    asoc->mapping_array_base_tsn,
 	    asoc->cumulative_tsn,
-	    asoc->highest_tsn_inside_map
-	    );
-	limit = asoc->mapping_array_size;
-	for (i = asoc->mapping_array_size; i >= 0; i--) {
-		if (asoc->mapping_array[i]) {
-			limit = i;
+	    asoc->highest_tsn_inside_map,
+	    asoc->highest_tsn_inside_nr_map);
+	for (limit = asoc->mapping_array_size; limit > 1; limit--) {
+		if (asoc->mapping_array[limit - 1]) {
 			break;
 		}
 	}
-	if (limit == 0)
-		limit = 1;
+	printf("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
 	for (i = 0; i < limit; i++) {
-		printf("%2.2x ", asoc->mapping_array[i]);
+		printf("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
 		if (((i + 1) % 16) == 0)
 			printf("\n");
 	}
-	printf("\n");
-	printf("NR Mapping size:%d baseTSN:%8.8x highestTSN:%8.8x\n",
-	    asoc->mapping_array_size,
-	    asoc->mapping_array_base_tsn,
-	    asoc->highest_tsn_inside_nr_map
-	    );
-	limit = asoc->mapping_array_size;
-	for (i = asoc->mapping_array_size; i >= 0; i--) {
-		if (asoc->nr_mapping_array[i]) {
-			limit = i;
+	if (limit % 16)
+		printf("\n");
+	for (limit = asoc->mapping_array_size; limit > 1; limit--) {
+		if (asoc->nr_mapping_array[limit - 1]) {
 			break;
 		}
 	}
-	if (limit == 0)
-		limit = 1;
-
+	printf("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
 	for (i = 0; i < limit; i++) {
-		printf("%2.2x ", asoc->nr_mapping_array[i]);
-		if (((i + 1) % 16) == 0)
-			printf("\n");
+		printf("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
 	}
-	printf("\n");
+	if (limit % 16)
+		printf("\n");
 }
 
 int
@@ -1240,9 +1228,7 @@ sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
 	uint8_t *new_array1, *new_array2;
 	uint32_t new_size;
 
-
 	new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
-
 	SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
 	SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
 	if ((new_array1 == NULL) || (new_array2 == NULL)) {