diff options
Diffstat (limited to 'chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_pcb.c')
| -rwxr-xr-x | chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_pcb.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_pcb.c b/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_pcb.c index 6efcbab91e8..355686fb904 100755 --- a/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_pcb.c +++ b/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_pcb.c @@ -34,7 +34,7 @@ #ifdef __FreeBSD__ #include <sys/cdefs.h> -__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 334532 2018-06-02 16:28:10Z tuexen $"); +__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 355931 2019-12-20 15:25:08Z tuexen $"); #endif #include <netinet/sctp_os.h> @@ -7246,7 +7246,7 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m, if (offset + plen > limit) { break; } - if (plen == 0) { + if (plen < sizeof(struct sctp_paramhdr)) { break; } #ifdef INET @@ -7462,6 +7462,9 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m, if (plen > sizeof(lstore)) { return (-23); } + if (plen < sizeof(struct sctp_asconf_addrv4_param)) { + return (-101); + } phdr = sctp_get_next_param(m, offset, (struct sctp_paramhdr *)&lstore, plen); |