Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 23 Aug 2020 22:40:39 +0000 (UTC)
From:      Michael Tuexen <tuexen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org
Subject:   svn commit: r364580 - stable/12/sys/netinet
Message-ID:  <202008232240.07NMedeb005755@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: tuexen
Date: Sun Aug 23 22:40:38 2020
New Revision: 364580
URL: https://svnweb.freebsd.org/changeset/base/364580

Log:
  MFC r360671:
  Avoid underflowing a variable, which would result in taking more
  data from the stream queues then needed.
  
  Thanks to Timo Voelker for finding this bug and providing a fix.

Modified:
  stable/12/sys/netinet/sctp_output.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/sctp_output.c
==============================================================================
--- stable/12/sys/netinet/sctp_output.c	Sun Aug 23 22:39:06 2020	(r364579)
+++ stable/12/sys/netinet/sctp_output.c	Sun Aug 23 22:40:38 2020	(r364580)
@@ -7769,7 +7769,11 @@ sctp_fill_outqueue(struct sctp_tcb *stcb,
 		}
 		strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc);
 		total_moved += moved;
-		space_left -= moved;
+		if (space_left >= moved) {
+			space_left -= moved;
+		} else {
+			space_left = 0;
+		}
 		if (space_left >= SCTP_DATA_CHUNK_OVERHEAD(stcb)) {
 			space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb);
 		} else {



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202008232240.07NMedeb005755>