svn commit: r353071 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Thu Oct  3 20:47:57 2019
New Revision: 353071
URL: https://svnweb.freebsd.org/changeset/base/353071

Log:
  When skipping the address parameter, take the padding into account.
  
  MFC after:		3 days

Modified:
  head/sys/netinet/sctp_asconf.c

Modified: head/sys/netinet/sctp_asconf.c
==============================================================================
--- head/sys/netinet/sctp_asconf.c	Thu Oct  3 20:45:52 2019	(r353070)
+++ head/sys/netinet/sctp_asconf.c	Thu Oct  3 20:47:57 2019	(r353071)
@@ -699,8 +699,8 @@ sctp_handle_asconf(struct mbuf *m, unsigned int offset
 		sctp_m_freem(m_ack);
 		return;
 	}
-	/* param_length is already validated in process_control... */
-	offset += ntohs(p_addr->ph.param_length);	/* skip lookup addr */
+	/* skip lookup addr */
+	offset += SCTP_SIZE32(ntohs(p_addr->ph.param_length));
 	/* get pointer to first asconf param in ASCONF */
 	aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *)&aparam_buf);
 	if (aph == NULL) {