Author: tuexen
Date: Thu May 16 08:38:20 2019
New Revision: 347654
URL: https://svnweb.freebsd.org/changeset/base/347654
Log:
MFC r343769:
Fix an off-by-one error in the input validation of the SCTP_RESET_STREAMS
socketoption.
This was found by running syzkaller.
Modified:
stable/11/sys/netinet/sctp_usrreq.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/netinet/sctp_usrreq.c
==============================================================================
--- stable/11/sys/netinet/sctp_usrreq.c Thu May 16 08:26:44 2019
(r347653)
+++ stable/11/sys/netinet/sctp_usrreq.c Thu May 16 08:38:20 2019
(r347654)
@@ -4654,13 +4654,13 @@ sctp_setopt(struct socket *so, int optname, void *optv
}
for (i = 0; i < strrst->srs_number_streams; i++) {
if ((send_in) &&
- (strrst->srs_stream_list[i] >
stcb->asoc.streamincnt)) {
+ (strrst->srs_stream_list[i] >=
stcb->asoc.streamincnt)) {
SCTP_LTRACE_ERR_RET(inp, NULL, NULL,
SCTP_FROM_SCTP_USRREQ, EINVAL);
error = EINVAL;
break;
}
if ((send_out) &&
- (strrst->srs_stream_list[i] >
stcb->asoc.streamoutcnt)) {
+ (strrst->srs_stream_list[i] >=
stcb->asoc.streamoutcnt)) {
SCTP_LTRACE_ERR_RET(inp, NULL, NULL,
SCTP_FROM_SCTP_USRREQ, EINVAL);
error = EINVAL;
break;
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
