UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

[SCTP]: Fix sctp_rcv_ootb() to handle the last chunk of a packet correctly. 

Signed-off-by: Tsutomu Fujii <t-fujii@nb.jp.nec.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
This commit is contained in:
Tsutomu Fujii 2006-01-17 11:57:09 -08:00 committed by Sridhar Samudrala
parent c4d2444e99
commit a7d1f1b66c
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
net/sctp/input.c
View File

@ -588,10 +588,16 @@ int sctp_rcv_ootb(struct sk_buff *skb)
sctp_errhdr_t *err; sctp_errhdr_t *err;
ch = (sctp_chunkhdr_t *) skb->data; ch = (sctp_chunkhdr_t *) skb->data;
ch_end = ((__u8 *) ch) + WORD_ROUND(ntohs(ch->length));
/* Scan through all the chunks in the packet. */ /* Scan through all the chunks in the packet. */
while (ch_end > (__u8 *)ch && ch_end < skb->tail) { do {
/* Break out if chunk length is less then minimal. */
if (ntohs(ch->length) < sizeof(sctp_chunkhdr_t))
break;
ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
if (ch_end > skb->tail)
break;
/* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the /* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the
* receiver MUST silently discard the OOTB packet and take no * receiver MUST silently discard the OOTB packet and take no
@ -622,8 +628,7 @@ int sctp_rcv_ootb(struct sk_buff *skb)
} }
ch = (sctp_chunkhdr_t *) ch_end; ch = (sctp_chunkhdr_t *) ch_end;
ch_end = ((__u8 *) ch) + WORD_ROUND(ntohs(ch->length)); } while (ch_end < skb->tail);
}
return 0; return 0;

2
net/sctp/sm_statefuns.c
View File

@ -3090,6 +3090,8 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
break; break;
ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
if (ch_end > skb->tail)
break;
if (SCTP_CID_SHUTDOWN_ACK == ch->type) if (SCTP_CID_SHUTDOWN_ACK == ch->type)
ootb_shut_ack = 1; ootb_shut_ack = 1;