diff options
author | Shan Wei <shanwei@cn.fujitsu.com> | 2011-04-19 17:25:40 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2011-04-20 04:51:01 -0400 |
commit | 8a00be1c89cc17fda5f438794ff27449af6f00f1 (patch) | |
tree | a9b01d90300f59ca15b5f38a0c3804ccca6bb719 /net/sctp/sm_statefuns.c | |
parent | 882553752196605bf27057e7adb298ecae8058c4 (diff) |
sctp: check parameter value of length in ERROR chunk
When an endpoint receives ERROR that parameter value is invalid,
send an ABORT to peer with a Protocol Violation error code.
Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp/sm_statefuns.c')
-rw-r--r-- | net/sctp/sm_statefuns.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index c08547270e8e..fe2036d79f53 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c | |||
@@ -3204,6 +3204,7 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep, | |||
3204 | sctp_cmd_seq_t *commands) | 3204 | sctp_cmd_seq_t *commands) |
3205 | { | 3205 | { |
3206 | struct sctp_chunk *chunk = arg; | 3206 | struct sctp_chunk *chunk = arg; |
3207 | sctp_errhdr_t *err; | ||
3207 | 3208 | ||
3208 | if (!sctp_vtag_verify(chunk, asoc)) | 3209 | if (!sctp_vtag_verify(chunk, asoc)) |
3209 | return sctp_sf_pdiscard(ep, asoc, type, arg, commands); | 3210 | return sctp_sf_pdiscard(ep, asoc, type, arg, commands); |
@@ -3212,6 +3213,10 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep, | |||
3212 | if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t))) | 3213 | if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t))) |
3213 | return sctp_sf_violation_chunklen(ep, asoc, type, arg, | 3214 | return sctp_sf_violation_chunklen(ep, asoc, type, arg, |
3214 | commands); | 3215 | commands); |
3216 | sctp_walk_errors(err, chunk->chunk_hdr); | ||
3217 | if ((void *)err != (void *)chunk->chunk_end) | ||
3218 | return sctp_sf_violation_paramlen(ep, asoc, type, arg, | ||
3219 | (void *)err, commands); | ||
3215 | 3220 | ||
3216 | sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR, | 3221 | sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR, |
3217 | SCTP_CHUNK(chunk)); | 3222 | SCTP_CHUNK(chunk)); |