diff options
| author | Patrick McHardy <kaber@trash.net> | 2006-03-12 23:34:53 -0500 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-03-12 23:39:39 -0500 |
| commit | 4a1ff6e2bde56cdf176bd54d557b2e15e819f810 (patch) | |
| tree | c831cb72a76e69b3e781f070c510a59b06e39cb9 /net/ipv4/tcp_highspeed.c | |
| parent | cc9a06cd8d6fbb69b4d3c46760c132cfe312fb85 (diff) | |
[TCP]: tcp_highspeed: fix AIMD table out-of-bounds access
Covertiy #547
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_highspeed.c')
| -rw-r--r-- | net/ipv4/tcp_highspeed.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c index 63cf7e540847..e0e9d1383c7c 100644 --- a/net/ipv4/tcp_highspeed.c +++ b/net/ipv4/tcp_highspeed.c | |||
| @@ -125,7 +125,7 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt, | |||
| 125 | /* Update AIMD parameters */ | 125 | /* Update AIMD parameters */ |
| 126 | if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) { | 126 | if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) { |
| 127 | while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd && | 127 | while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd && |
| 128 | ca->ai < HSTCP_AIMD_MAX) | 128 | ca->ai < HSTCP_AIMD_MAX - 1) |
| 129 | ca->ai++; | 129 | ca->ai++; |
| 130 | } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) { | 130 | } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) { |
| 131 | while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd && | 131 | while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd && |