Fix the acconting for fragmented unordered messages when using
interleaving. This was reported for the userland stack in https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19321 MFC after: 1 week
This commit is contained in:
parent
6e26dd0dbe
commit
132c073866
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=362581
@ -1111,6 +1111,16 @@ sctp_deliver_reasm_check(struct sctp_tcb *stcb, struct sctp_association *asoc,
|
||||
#endif
|
||||
SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
|
||||
TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
|
||||
if (asoc->size_on_all_streams >= control->length) {
|
||||
asoc->size_on_all_streams -= control->length;
|
||||
} else {
|
||||
#ifdef INVARIANTS
|
||||
panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
|
||||
#else
|
||||
asoc->size_on_all_streams = 0;
|
||||
#endif
|
||||
}
|
||||
sctp_ucount_decr(asoc->cnt_on_all_streams);
|
||||
control->on_strm_q = 0;
|
||||
}
|
||||
if (control->on_read_q == 0) {
|
||||
@ -1391,7 +1401,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
|
||||
}
|
||||
/* Must be added to the stream-in queue */
|
||||
if (created_control) {
|
||||
if (unordered == 0) {
|
||||
if ((unordered == 0) || (asoc->idata_supported)) {
|
||||
sctp_ucount_incr(asoc->cnt_on_all_streams);
|
||||
}
|
||||
if (sctp_place_control_in_stream(strm, asoc, control)) {
|
||||
|
Loading…
Reference in New Issue
Block a user