git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
| inline |
side by side
[SCTP]: Fix sctp_rcv_ootb() to handle the last chunk of a packet correctly.
[pandora-kernel.git]
/
net
/
sctp
/
sm_statefuns.c
diff --git
a/net/sctp/sm_statefuns.c
b/net/sctp/sm_statefuns.c
index
477d7f8
..
71c9a96
100644
(file)
--- a/
net/sctp/sm_statefuns.c
+++ b/
net/sctp/sm_statefuns.c
@@
-3090,6
+3090,8
@@
sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
break;
ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
+ if (ch_end > skb->tail)
+ break;
if (SCTP_CID_SHUTDOWN_ACK == ch->type)
ootb_shut_ack = 1;