aboutsummaryrefslogtreecommitdiffstats
path: root/net/sctp/sm_statefuns.c
diff options
context:
space:
mode:
authorShan Wei <shanwei@cn.fujitsu.com>2011-04-19 17:25:40 -0400
committerDavid S. Miller <davem@davemloft.net>2011-04-20 04:51:01 -0400
commit8a00be1c89cc17fda5f438794ff27449af6f00f1 (patch)
treea9b01d90300f59ca15b5f38a0c3804ccca6bb719 /net/sctp/sm_statefuns.c
parent882553752196605bf27057e7adb298ecae8058c4 (diff)
sctp: check parameter value of length in ERROR chunk
When an endpoint receives ERROR that parameter value is invalid, send an ABORT to peer with a Protocol Violation error code. Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp/sm_statefuns.c')
-rw-r--r--net/sctp/sm_statefuns.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index c08547270e8e..fe2036d79f53 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3204,6 +3204,7 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
3204 sctp_cmd_seq_t *commands) 3204 sctp_cmd_seq_t *commands)
3205{ 3205{
3206 struct sctp_chunk *chunk = arg; 3206 struct sctp_chunk *chunk = arg;
3207 sctp_errhdr_t *err;
3207 3208
3208 if (!sctp_vtag_verify(chunk, asoc)) 3209 if (!sctp_vtag_verify(chunk, asoc))
3209 return sctp_sf_pdiscard(ep, asoc, type, arg, commands); 3210 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -3212,6 +3213,10 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
3212 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t))) 3213 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
3213 return sctp_sf_violation_chunklen(ep, asoc, type, arg, 3214 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3214 commands); 3215 commands);
3216 sctp_walk_errors(err, chunk->chunk_hdr);
3217 if ((void *)err != (void *)chunk->chunk_end)
3218 return sctp_sf_violation_paramlen(ep, asoc, type, arg,
3219 (void *)err, commands);
3215 3220
3216 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR, 3221 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
3217 SCTP_CHUNK(chunk)); 3222 SCTP_CHUNK(chunk));