Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8a00be1c authored by Shan Wei's avatar Shan Wei Committed by David S. Miller
Browse files

sctp: check parameter value of length in ERROR chunk 



When an endpoint receives ERROR that parameter value is invalid,
send an ABORT to peer with a Protocol Violation error code.

Signed-off-by: default avatarShan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: default avatarWei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 88255375

net/sctp/sm_statefuns.c

+5 −0
Original line number Diff line number Diff line
@@ -3204,6 +3204,7 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep, 
					sctp_cmd_seq_t *commands)

{

	struct sctp_chunk *chunk = arg;

	sctp_errhdr_t *err;



	if (!sctp_vtag_verify(chunk, asoc))

		return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -3212,6 +3213,10 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep, 
	if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))

		return sctp_sf_violation_chunklen(ep, asoc, type, arg,

						  commands);

	sctp_walk_errors(err, chunk->chunk_hdr);

	if ((void *)err != (void *)chunk->chunk_end)

		return sctp_sf_violation_paramlen(ep, asoc, type, arg,

						  (void *)err, commands);



	sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,

			SCTP_CHUNK(chunk));