diff options
| author | Michael Tuexen <tuexen@FreeBSD.org> | 2019-09-16 08:18:05 +0000 |
|---|---|---|
| committer | Michael Tuexen <tuexen@FreeBSD.org> | 2019-09-16 08:18:05 +0000 |
| commit | 5b66b7f11b9257c8c60819867877b46b1af0aff2 (patch) | |
| tree | 606a9775ebaa8df13e6d261194e1c18a6c7f9833 /sys/netinet/tcp_sack.c | |
| parent | f370355791012d22908c38f75872393b9074605a (diff) | |
Don't write to memory outside of the allocated array for SACK blocks.
Obtained from: rrs@
MFC after: 3 days
Sponsored by: Netflix, Inc.
Notes
Notes:
svn path=/head/; revision=352386
Diffstat (limited to 'sys/netinet/tcp_sack.c')
| -rw-r--r-- | sys/netinet/tcp_sack.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/netinet/tcp_sack.c b/sys/netinet/tcp_sack.c index 999fb4f5890b..311a84b989a9 100644 --- a/sys/netinet/tcp_sack.c +++ b/sys/netinet/tcp_sack.c @@ -235,7 +235,7 @@ tcp_update_dsack_list(struct tcpcb *tp, tcp_seq rcv_start, tcp_seq rcv_end) saved_blks[n].start = mid_blk.start; saved_blks[n++].end = mid_blk.end; } - for (j = 0; (j < tp->rcv_numsacks) && (j < MAX_SACK_BLKS-1); j++) { + for (j = 0; (j < tp->rcv_numsacks) && (n < MAX_SACK_BLKS); j++) { if (((SEQ_LT(tp->sackblks[j].end, mid_blk.start) || SEQ_GT(tp->sackblks[j].start, mid_blk.end)) && (SEQ_GT(tp->sackblks[j].start, tp->rcv_nxt)))) |