1 files changed, 5 insertions, 0 deletions

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index c08547270e8e..fe2036d79f53 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3204,6 +3204,7 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
                                         sctp_cmd_seq_t *commands)
 {
         struct sctp_chunk *chunk = arg;
+        sctp_errhdr_t *err;
 
         if (!sctp_vtag_verify(chunk, asoc))
                 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -3212,6 +3213,10 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
                 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
                                                   commands);
+        sctp_walk_errors(err, chunk->chunk_hdr);
+        if ((void *)err != (void *)chunk->chunk_end)
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+                                                  (void *)err, commands);
 
         sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
                         SCTP_CHUNK(chunk));