1 files changed, 8 insertions, 4 deletions

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index f3c95f9bd413..4dcdabf56473 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4164,6 +4164,7 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len,
         rwlock_t *addr_lock;
         int err = 0;
         void *addrs;
+        void *buf;
         int bytes_copied = 0;
 
         if (len != sizeof(struct sctp_getaddrs_old))
@@ -4217,13 +4218,14 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len,
                 }
         }
 
+        buf = addrs;
         list_for_each(pos, &bp->address_list) {
                 addr = list_entry(pos, struct sctp_sockaddr_entry, list);
                 memcpy(&temp, &addr->a, sizeof(temp));
                 sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp);
                 addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
-                memcpy(addrs, &temp, addrlen);
-                to += addrlen;
+                memcpy(buf, &temp, addrlen);
+                buf += addrlen;
                 bytes_copied += addrlen;
                 cnt ++;
                 if (cnt >= getaddrs.addr_num) break;
@@ -4266,6 +4268,7 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
         size_t space_left;
         int bytes_copied = 0;
         void *addrs;
+        void *buf;
 
         if (len <= sizeof(struct sctp_getaddrs))
                 return -EINVAL;
@@ -4316,6 +4319,7 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
                 }
         }
 
+        buf = addrs;
         list_for_each(pos, &bp->address_list) {
                 addr = list_entry(pos, struct sctp_sockaddr_entry, list);
                 memcpy(&temp, &addr->a, sizeof(temp));
@@ -4325,8 +4329,8 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
                         err =  -ENOMEM; /*fixme: right error?*/
                         goto error;
                 }
-                memcpy(addrs, &temp, addrlen);
-                to += addrlen;
+                memcpy(buf, &temp, addrlen);
+                buf += addrlen;
                 bytes_copied += addrlen;
                 cnt ++;
                 space_left -= addrlen;