Fix an off-by-one error in the input validation of the SCTP_RESET_STREAMS
socketoption. This was found by running syzkaller. MFC after: 3 days
This commit is contained in:
parent
cc9b5471a0
commit
e4c42fa266
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=343769
@ -4654,13 +4654,13 @@ sctp_setopt(struct socket *so, int optname, void *optval, size_t optsize,
|
||||
}
|
||||
for (i = 0; i < strrst->srs_number_streams; i++) {
|
||||
if ((send_in) &&
|
||||
(strrst->srs_stream_list[i] > stcb->asoc.streamincnt)) {
|
||||
(strrst->srs_stream_list[i] >= stcb->asoc.streamincnt)) {
|
||||
SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL);
|
||||
error = EINVAL;
|
||||
break;
|
||||
}
|
||||
if ((send_out) &&
|
||||
(strrst->srs_stream_list[i] > stcb->asoc.streamoutcnt)) {
|
||||
(strrst->srs_stream_list[i] >= stcb->asoc.streamoutcnt)) {
|
||||
SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL);
|
||||
error = EINVAL;
|
||||
break;
|
||||
|
Loading…
Reference in New Issue
Block a user