d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't use stack memory which is not initialized.

Browse Source 
Thanks to Mark Wodrich for reporting this issue for the userland stack in
https://github.com/sctplab/usrsctp/issues/380
This issue was also found for usrsctp by OSS-fuzz in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17778

MFC after:		3 days
This commit is contained in:
Michael Tuexen 2019-09-30 12:06:57 +00:00
parent 164e7901a0
commit 2974e263c3
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
sys/netinet/sctp_asconf.c
View File

@ -236,6 +236,7 @@ sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *ap
"process_asconf_add_ip: using source addr "); "process_asconf_add_ip: using source addr ");
SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src); SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
} }
net = NULL;
/* add the address */ /* add the address */
if (bad_address) { if (bad_address) {
m_reply = sctp_asconf_error_response(aph->correlation_id, m_reply = sctp_asconf_error_response(aph->correlation_id,
@ -250,17 +251,19 @@ sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *ap
SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *)aph, SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *)aph,
aparam_length); aparam_length);
} else { } else {
/* notify upper layer */
sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
if (response_required) { if (response_required) {
m_reply = m_reply =
sctp_asconf_success_response(aph->correlation_id); sctp_asconf_success_response(aph->correlation_id);
} }
sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net); if (net != NULL) {
sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, /* notify upper layer */
stcb, net); sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
if (send_hb) { sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED); sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
stcb, net);
if (send_hb) {
sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
}
} }
} }
return (m_reply); return (m_reply);