svn commit: r353403 - stable/12/sys/netinet
Michael Tuexen
tuexen at FreeBSD.org
Thu Oct 10 14:56:30 UTC 2019
Author: tuexen
Date: Thu Oct 10 14:56:29 2019
New Revision: 353403
URL: https://svnweb.freebsd.org/changeset/base/353403
Log:
MFC r353303:
Validate length before use it, not vice versa.
r353060 should have contained this...
This fixes
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18070
Modified:
stable/12/sys/netinet/sctp_asconf.c
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/sys/netinet/sctp_asconf.c
==============================================================================
--- stable/12/sys/netinet/sctp_asconf.c Thu Oct 10 14:54:22 2019 (r353402)
+++ stable/12/sys/netinet/sctp_asconf.c Thu Oct 10 14:56:29 2019 (r353403)
@@ -334,11 +334,11 @@ sctp_process_asconf_delete_ip(struct sockaddr *src,
#endif
aparam_length = ntohs(aph->ph.param_length);
- ph = (struct sctp_paramhdr *)(aph + 1);
- param_type = ntohs(ph->param_type);
if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
return (NULL);
}
+ ph = (struct sctp_paramhdr *)(aph + 1);
+ param_type = ntohs(ph->param_type);
#if defined(INET) || defined(INET6)
param_length = ntohs(ph->param_length);
if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
More information about the svn-src-all
mailing list