Date: Wed, 25 Oct 2017 07:57:14 -0700 (PDT) From: "Rodney W. Grimes" <freebsd@pdx.rh.CN85.dnsmgr.net> To: Michael Tuexen <tuexen@freebsd.org> Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r324971 - head/sys/netinet Message-ID: <201710251457.v9PEvEZU052398@pdx.rh.CN85.dnsmgr.net> In-Reply-To: <201710250912.v9P9CMar060973@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[ Charset UTF-8 unsupported, converting... ] > Author: tuexen > Date: Wed Oct 25 09:12:22 2017 > New Revision: 324971 > URL: https://svnweb.freebsd.org/changeset/base/324971 > > Log: > Fix a bug reported by Felix Weinrank using the libfuzzer on the > userland stack. Please try to say what the bug was, why it was a bug, and how it was fixed in any bug commit message. External vague references are of little value when reading through a files svn history. Thanks, > > MFC after: 3 days > > Modified: > head/sys/netinet/sctp_auth.c > > Modified: head/sys/netinet/sctp_auth.c > ============================================================================== > --- head/sys/netinet/sctp_auth.c Wed Oct 25 05:55:13 2017 (r324970) > +++ head/sys/netinet/sctp_auth.c Wed Oct 25 09:12:22 2017 (r324971) > @@ -1606,9 +1606,9 @@ sctp_zero_m(struct mbuf *m, uint32_t m_offset, uint32_ > /* now use the rest of the mbuf chain */ > while ((m_tmp != NULL) && (size > 0)) { > data = mtod(m_tmp, uint8_t *)+m_offset; > - if (size > (uint32_t)SCTP_BUF_LEN(m_tmp)) { > - memset(data, 0, SCTP_BUF_LEN(m_tmp)); > - size -= SCTP_BUF_LEN(m_tmp); > + if (size > (uint32_t)(SCTP_BUF_LEN(m_tmp) - m_offset)) { > + memset(data, 0, SCTP_BUF_LEN(m_tmp) - m_offset); > + size -= SCTP_BUF_LEN(m_tmp) - m_offset; > } else { > memset(data, 0, size); > size = 0; > > -- Rod Grimes rgrimes@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201710251457.v9PEvEZU052398>