Author: tuexen
Date: Sun Mar 24 09:46:16 2019
New Revision: 345465
URL: https://svnweb.freebsd.org/changeset/base/345465
Log:
Fix a signed/unsigned bug when receiving SCTP messages.
This is joint work with rrs@.
Reported by: syzbot+6b8a4bc8cc828e9d9...@syzkaller.appspotmail.com
MFC after: 1 week
Modified:
head/sys/netinet/sctputil.c
Modified: head/sys/netinet/sctputil.c
==============================================================================
--- head/sys/netinet/sctputil.c Sun Mar 24 06:28:25 2019 (r345464)
+++ head/sys/netinet/sctputil.c Sun Mar 24 09:46:16 2019 (r345465)
@@ -5219,8 +5219,9 @@ sctp_sorecvmsg(struct socket *so,
*
*/
struct sctp_inpcb *inp = NULL;
- int my_len = 0;
- int cp_len = 0, error = 0;
+ size_t my_len = 0;
+ size_t cp_len = 0;
+ int error = 0;
struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
struct mbuf *m = NULL;
struct sctp_tcb *stcb = NULL;
@@ -5728,8 +5729,8 @@ get_more_data:
m = control->data;
while (m) {
/* Move out all we can */
- cp_len = (int)uio->uio_resid;
- my_len = (int)SCTP_BUF_LEN(m);
+ cp_len = uio->uio_resid;
+ my_len = SCTP_BUF_LEN(m);
if (cp_len > my_len) {
/* not enough in this buf */
cp_len = my_len;
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
