From ab6f49802f3df58093d69e4cf7525580191b0146 Mon Sep 17 00:00:00 2001 From: tuexen Date: Sat, 9 Sep 2017 19:49:50 +0000 Subject: [PATCH] Savely remove a chunk from the control queue. This bug was found by Coverity scanning the usrsctp library. MFC after: 3 days --- sys/netinet/sctp_input.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/netinet/sctp_input.c b/sys/netinet/sctp_input.c index 07d4e85e49b4..5005a6d5fbe7 100644 --- a/sys/netinet/sctp_input.c +++ b/sys/netinet/sctp_input.c @@ -3133,14 +3133,14 @@ sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sct * make sure that we have a covered ECNE in the control chunk part. * If so remove it. */ - struct sctp_tmit_chunk *chk; + struct sctp_tmit_chunk *chk, *nchk; struct sctp_ecne_chunk *ecne; int override; uint32_t cwr_tsn; cwr_tsn = ntohl(cp->tsn); override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE; - TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) { + TAILQ_FOREACH_SAFE(chk, &stcb->asoc.control_send_queue, sctp_next, nchk) { if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) { continue; }