sctp: check parameter value of length in ERROR chunk
When an endpoint receives ERROR that parameter value is invalid, send an ABORT to peer with a Protocol Violation error code. Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
8825537521
commit
8a00be1c89
|
@ -3204,6 +3204,7 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
|
||||||
sctp_cmd_seq_t *commands)
|
sctp_cmd_seq_t *commands)
|
||||||
{
|
{
|
||||||
struct sctp_chunk *chunk = arg;
|
struct sctp_chunk *chunk = arg;
|
||||||
|
sctp_errhdr_t *err;
|
||||||
|
|
||||||
if (!sctp_vtag_verify(chunk, asoc))
|
if (!sctp_vtag_verify(chunk, asoc))
|
||||||
return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
|
return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
|
||||||
|
@ -3212,6 +3213,10 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
|
||||||
if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
|
if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
|
||||||
return sctp_sf_violation_chunklen(ep, asoc, type, arg,
|
return sctp_sf_violation_chunklen(ep, asoc, type, arg,
|
||||||
commands);
|
commands);
|
||||||
|
sctp_walk_errors(err, chunk->chunk_hdr);
|
||||||
|
if ((void *)err != (void *)chunk->chunk_end)
|
||||||
|
return sctp_sf_violation_paramlen(ep, asoc, type, arg,
|
||||||
|
(void *)err, commands);
|
||||||
|
|
||||||
sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
|
sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
|
||||||
SCTP_CHUNK(chunk));
|
SCTP_CHUNK(chunk));
|
||||||
|
|
Loading…
Reference in New Issue