aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGerrit Renker <gerrit@erg.abdn.ac.uk>2006-12-09 20:59:14 -0500
committerDavid S. Miller <davem@sunset.davemloft.net>2006-12-11 17:34:39 -0500
commit45393a66a2c30fc8ed86e6c79a63a3cd5231c69f (patch)
tree628feedd3d6d1fbdb1728d57e4bb62e1fc61e5c4
parent5fce9a2da8a3b4ed088d9c0ac7c938a638044fdb (diff)
[DCCP] ccid3: Check against too large p
This patch follows a suggestion by Ian McDonald and ensures that in the current code the value of p can not exceed 100%. Such a value is illegal and would consequently cause a bug condition in tfrc_calc_x(). The receiver case is also tested, and a warning message is added. Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
-rw-r--r--net/dccp/ccids/ccid3.c13
1 files changed, 9 insertions, 4 deletions
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 66a27b9688ca..f1b745ee9cb6 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -444,9 +444,9 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
444 444
445 /* Update loss event rate */ 445 /* Update loss event rate */
446 pinv = opt_recv->ccid3or_loss_event_rate; 446 pinv = opt_recv->ccid3or_loss_event_rate;
447 if (pinv == ~0U || pinv == 0) 447 if (pinv == ~0U || pinv == 0) /* see RFC 4342, 8.5 */
448 hctx->ccid3hctx_p = 0; 448 hctx->ccid3hctx_p = 0;
449 else 449 else /* can not exceed 100% */
450 hctx->ccid3hctx_p = 1000000 / pinv; 450 hctx->ccid3hctx_p = 1000000 / pinv;
451 451
452 dccp_timestamp(sk, &now); 452 dccp_timestamp(sk, &now);
@@ -733,10 +733,15 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk)
733 /* Convert to multiples of 10us */ 733 /* Convert to multiples of 10us */
734 hcrx->ccid3hcrx_elapsed_time = 734 hcrx->ccid3hcrx_elapsed_time =
735 timeval_delta(&now, &packet->dccphrx_tstamp) / 10; 735 timeval_delta(&now, &packet->dccphrx_tstamp) / 10;
736
736 if (hcrx->ccid3hcrx_p == 0) 737 if (hcrx->ccid3hcrx_p == 0)
737 hcrx->ccid3hcrx_pinv = ~0; 738 hcrx->ccid3hcrx_pinv = ~0U; /* see RFC 4342, 8.5 */
738 else 739 else if (hcrx->ccid3hcrx_p > 1000000) {
740 DCCP_WARN("p (%u) > 100%%\n", hcrx->ccid3hcrx_p);
741 hcrx->ccid3hcrx_pinv = 1; /* use 100% in this case */
742 } else
739 hcrx->ccid3hcrx_pinv = 1000000 / hcrx->ccid3hcrx_p; 743 hcrx->ccid3hcrx_pinv = 1000000 / hcrx->ccid3hcrx_p;
744
740 dp->dccps_hc_rx_insert_options = 1; 745 dp->dccps_hc_rx_insert_options = 1;
741 dccp_send_ack(sk); 746 dccp_send_ack(sk);
742} 747}