Date: Sun, 24 Mar 2019 09:46:16 +0000 (UTC) From: Michael Tuexen <tuexen@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r345465 - head/sys/netinet Message-ID: <201903240946.x2O9kGHR023306@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tuexen Date: Sun Mar 24 09:46:16 2019 New Revision: 345465 URL: https://svnweb.freebsd.org/changeset/base/345465 Log: Fix a signed/unsigned bug when receiving SCTP messages. This is joint work with rrs@. Reported by: syzbot+6b8a4bc8cc828e9d9790@syzkaller.appspotmail.com MFC after: 1 week Modified: head/sys/netinet/sctputil.c Modified: head/sys/netinet/sctputil.c ============================================================================== --- head/sys/netinet/sctputil.c Sun Mar 24 06:28:25 2019 (r345464) +++ head/sys/netinet/sctputil.c Sun Mar 24 09:46:16 2019 (r345465) @@ -5219,8 +5219,9 @@ sctp_sorecvmsg(struct socket *so, * */ struct sctp_inpcb *inp = NULL; - int my_len = 0; - int cp_len = 0, error = 0; + size_t my_len = 0; + size_t cp_len = 0; + int error = 0; struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL; struct mbuf *m = NULL; struct sctp_tcb *stcb = NULL; @@ -5728,8 +5729,8 @@ get_more_data: m = control->data; while (m) { /* Move out all we can */ - cp_len = (int)uio->uio_resid; - my_len = (int)SCTP_BUF_LEN(m); + cp_len = uio->uio_resid; + my_len = SCTP_BUF_LEN(m); if (cp_len > my_len) { /* not enough in this buf */ cp_len = my_len;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201903240946.x2O9kGHR023306>