Validate length before use it, not vice versa.
r353060 should have contained this... This fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18070 MFC after: 3 days
This commit is contained in:
parent
a362cf527e
commit
953b78bed9
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=353303
@ -334,11 +334,11 @@ sctp_process_asconf_delete_ip(struct sockaddr *src,
|
||||
#endif
|
||||
|
||||
aparam_length = ntohs(aph->ph.param_length);
|
||||
ph = (struct sctp_paramhdr *)(aph + 1);
|
||||
param_type = ntohs(ph->param_type);
|
||||
if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
|
||||
return (NULL);
|
||||
}
|
||||
ph = (struct sctp_paramhdr *)(aph + 1);
|
||||
param_type = ntohs(ph->param_type);
|
||||
#if defined(INET) || defined(INET6)
|
||||
param_length = ntohs(ph->param_length);
|
||||
if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
|
||||
|
Loading…
Reference in New Issue
Block a user