diff options
| author |   Wei Yongjun <yjwei@cn.fujitsu.com> | 2007-08-06 13:55:58 +0800 |
|---|---|---|
| committer |   Vlad Yasevich <vladislav.yasevich@hp.com> | 2007-08-30 16:44:27 -0400 |
| commit | cb243a1a9fef4aaff262a5dd14f987070d37229b (patch) | |
| tree | 5f15c06b52e98964070e56aaa6f8997ebf5f47ed /net | |
| parent | SCTP: Abort on COOKIE-ECHO if backlog is exceeded. (diff) | |
| download | linux-dev-cb243a1a9fef4aaff262a5dd14f987070d37229b.tar.xz linux-dev-cb243a1a9fef4aaff262a5dd14f987070d37229b.zip | |
SCTP: Fix to handle invalid parameter length correctly
If an INIT with invalid parameter length look like this:
Parameter Type : 1
Parameter Length: 800
and not contain any payload, SCTP will ignore this parameter and send
back a INIT-ACK.
This patch is fix to handle this invalid parameter length correctly.
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sctp/sm_make_chunk.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index adc5e5934728..79856c924525 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -1833,7 +1833,7 @@ int sctp_verify_init(const struct sctp_association *asoc, * VIOLATION error. We build the ERROR chunk here and let the normal * error handling code build and send the packet. */ - if (param.v < (void*)chunk->chunk_end - sizeof(sctp_paramhdr_t)) { + if (param.v != (void*)chunk->chunk_end) { sctp_process_inv_paramlength(asoc, param.p, chunk, errp); return 0; } |