diff options
| author |   Patrick McHardy <kaber@trash.net> | 2006-03-12 20:34:53 -0800 |
|---|---|---|
| committer |   David S. Miller <davem@sunset.davemloft.net> | 2006-03-12 20:39:39 -0800 |
| commit | 4a1ff6e2bde56cdf176bd54d557b2e15e819f810 (patch) | |
| tree | c831cb72a76e69b3e781f070c510a59b06e39cb9 /net/ipv4/tcp_highspeed.c | |
| parent | [NETLINK]: Fix use-after-free in netlink_recvmsg (diff) | |
| download | linux-dev-4a1ff6e2bde56cdf176bd54d557b2e15e819f810.tar.xz linux-dev-4a1ff6e2bde56cdf176bd54d557b2e15e819f810.zip | |
[TCP]: tcp_highspeed: fix AIMD table out-of-bounds access
Covertiy #547
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_highspeed.c')
| -rw-r--r-- | net/ipv4/tcp_highspeed.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c index 63cf7e540847..e0e9d1383c7c 100644 --- a/net/ipv4/tcp_highspeed.c +++ b/net/ipv4/tcp_highspeed.c @@ -125,7 +125,7 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt, /* Update AIMD parameters */ if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) { while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd && - ca->ai < HSTCP_AIMD_MAX) + ca->ai < HSTCP_AIMD_MAX - 1) ca->ai++; } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) { while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd && |