Date: Mon, 30 Sep 2019 04:54:02 +0000 (UTC) From: Michael Tuexen <tuexen@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r352886 - releng/12.1/sys/netinet Message-ID: <201909300454.x8U4s2Mc019209@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tuexen Date: Mon Sep 30 04:54:02 2019 New Revision: 352886 URL: https://svnweb.freebsd.org/changeset/base/352886 Log: MFS r352508: Don't write to memory outside of the allocated array for SACK blocks. PR: 240837 Approved by: re (delphij@) Obtained from: rrs@ Sponsored by: Netflix, Inc. Modified: releng/12.1/sys/netinet/tcp_sack.c Directory Properties: releng/12.1/ (props changed) Modified: releng/12.1/sys/netinet/tcp_sack.c ============================================================================== --- releng/12.1/sys/netinet/tcp_sack.c Mon Sep 30 03:35:48 2019 (r352885) +++ releng/12.1/sys/netinet/tcp_sack.c Mon Sep 30 04:54:02 2019 (r352886) @@ -235,7 +235,7 @@ tcp_update_dsack_list(struct tcpcb *tp, tcp_seq rcv_st saved_blks[n].start = mid_blk.start; saved_blks[n++].end = mid_blk.end; } - for (j = 0; (j < tp->rcv_numsacks) && (j < MAX_SACK_BLKS-1); j++) { + for (j = 0; (j < tp->rcv_numsacks) && (n < MAX_SACK_BLKS); j++) { if (((SEQ_LT(tp->sackblks[j].end, mid_blk.start) || SEQ_GT(tp->sackblks[j].start, mid_blk.end)) && (SEQ_GT(tp->sackblks[j].start, tp->rcv_nxt))))
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201909300454.x8U4s2Mc019209>