diff options
| author | Michael Tuexen <tuexen@FreeBSD.org> | 2021-06-27 14:10:39 +0000 |
|---|---|---|
| committer | Michael Tuexen <tuexen@FreeBSD.org> | 2021-07-13 18:27:58 +0000 |
| commit | 24df96b642531eb62572599d28f932590be9ba20 (patch) | |
| tree | 116d6b2e6f1fee2d8783291d5fb734339c31683b /sys | |
| parent | c5ba872129b3afee95953294fbe55e014559d408 (diff) | |
sctp: Fix length check for ECNE chunks
(cherry picked from commit 6587a2bd1e88b5b99aea114e3d20b0d4c48c95df)
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/netinet/sctp_input.c | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/sys/netinet/sctp_input.c b/sys/netinet/sctp_input.c index 442e58afd0ff..b822c9eae2ca 100644 --- a/sys/netinet/sctp_input.c +++ b/sys/netinet/sctp_input.c @@ -2887,10 +2887,6 @@ sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp, unsigned int pkt_cnt; len = ntohs(cp->ch.chunk_length); - if ((len != sizeof(struct sctp_ecne_chunk)) && - (len != sizeof(struct old_sctp_ecne_chunk))) { - return; - } if (len == sizeof(struct old_sctp_ecne_chunk)) { /* Its the old format */ memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk)); @@ -5022,7 +5018,8 @@ process_control_chunks: if (stcb->asoc.ecn_supported == 0) { goto unknown_chunk; } - if (chk_length != sizeof(struct sctp_ecne_chunk)) { + if ((chk_length != sizeof(struct sctp_ecne_chunk)) && + (chk_length != sizeof(struct old_sctp_ecne_chunk))) { break; } sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, stcb); |