git: 24df96b64253 - stable/13 - sctp: Fix length check for ECNE chunks

[Michael Tuexen]

The branch stable/13 has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=24df96b642531eb62572599d28f932590be9ba20

commit 24df96b642531eb62572599d28f932590be9ba20
Author:     Michael Tuexen <tuexen at FreeBSD.org>
AuthorDate: 2021-06-27 14:10:39 +0000
Commit:     Michael Tuexen <tuexen at FreeBSD.org>
CommitDate: 2021-07-13 18:27:58 +0000

    sctp: Fix length check for ECNE chunks
    
    (cherry picked from commit 6587a2bd1e88b5b99aea114e3d20b0d4c48c95df)
---
 sys/netinet/sctp_input.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/sys/netinet/sctp_input.c b/sys/netinet/sctp_input.c
index 442e58afd0ff..b822c9eae2ca 100644
--- a/sys/netinet/sctp_input.c
+++ b/sys/netinet/sctp_input.c
@@ -2887,10 +2887,6 @@ sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
 	unsigned int pkt_cnt;
 
 	len = ntohs(cp->ch.chunk_length);
-	if ((len != sizeof(struct sctp_ecne_chunk)) &&
-	    (len != sizeof(struct old_sctp_ecne_chunk))) {
-		return;
-	}
 	if (len == sizeof(struct old_sctp_ecne_chunk)) {
 		/* Its the old format */
 		memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
@@ -5022,7 +5018,8 @@ process_control_chunks:
 			if (stcb->asoc.ecn_supported == 0) {
 				goto unknown_chunk;
 			}
-			if (chk_length != sizeof(struct sctp_ecne_chunk)) {
+			if ((chk_length != sizeof(struct sctp_ecne_chunk)) &&
+			    (chk_length != sizeof(struct old_sctp_ecne_chunk))) {
 				break;
 			}
 			sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, stcb);