diff options
| author |   Wei Yongjun <yjwei@cn.fujitsu.com> | 2008-12-25 16:58:11 -0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2008-12-25 16:58:11 -0800 |
| commit | 9fcb95a105758b81ef0131cd18e2db5149f13e95 (patch) | |
| tree | fc38a5c1a91a5137bc385b8bdc7cb30539776222 /net/sctp/transport.c | |
| parent | sctp: Implement socket option SCTP_GET_ASSOC_NUMBER (diff) | |
| download | linux-dev-9fcb95a105758b81ef0131cd18e2db5149f13e95.tar.xz linux-dev-9fcb95a105758b81ef0131cd18e2db5149f13e95.zip | |
sctp: Avoid memory overflow while FWD-TSN chunk is received with bad stream ID
If FWD-TSN chunk is received with bad stream ID, the sctp will not do the
validity check, this may cause memory overflow when overwrite the TSN of
the stream ID.
The FORWARD-TSN chunk is like this:
FORWARD-TSN chunk
Type = 192
Flags = 0
Length = 172
NewTSN = 99
Stream = 10000
StreamSequence = 0xFFFF
This patch fix this problem by discard the chunk if stream ID is not
less than MIS.
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp/transport.c')
0 files changed, 0 insertions, 0 deletions