https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224103
Bug ID: 224103
Summary: A possible out of bounds of memory in
netinet/libalias/alias_sctp.c.
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
In AliasSctpInit():
la->sctpNatTimer.TimerQ = sn_calloc(SN_TIMER_QUEUE_SIZE, sizeof(struct
sctpTimerQ));
since SN_TIMER_QUEUE_SIZE is defined as SN_MAX_TIMER+2, and sn_calloc is
defined as sn_malloc(x * n) if _SYS_MALLOC_H_ is defined, the size of calloced
memory will be wrong, because the macro will be expanded to
SN_MAX_TIMER+2*sizeof(struct sctpTimerQ).
This was found when i compiled the code on Linux, i don't know whether it's a
problem or not if compiled on FreeBSD system.
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
