svn commit: r353452 - head/sys/netinet

Michael Tuexen tuexen at FreeBSD.org
Sat Oct 12 17:57:04 UTC 2019


Author: tuexen
Date: Sat Oct 12 17:57:03 2019
New Revision: 353452
URL: https://svnweb.freebsd.org/changeset/base/353452

Log:
  Ensure that local variables are reset to their initial value when
  dealing with error cases in a loop over all remote addresses.
  This issue was found and reported by OSS_Fuzz in:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18080
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18086
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18121
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18163
  
  MFC after:		3 days

Modified:
  head/sys/netinet/sctp_output.c

Modified: head/sys/netinet/sctp_output.c
==============================================================================
--- head/sys/netinet/sctp_output.c	Sat Oct 12 17:15:32 2019	(r353451)
+++ head/sys/netinet/sctp_output.c	Sat Oct 12 17:57:03 2019	(r353452)
@@ -7872,8 +7872,8 @@ sctp_med_chunk_output(struct sctp_inpcb *inp,
 	int bundle_at, ctl_cnt, no_data_chunks, eeor_mode;
 	unsigned int mtu, r_mtu, omtu, mx_mtu, to_out;
 	int tsns_sent = 0;
-	uint32_t auth_offset = 0;
-	struct sctp_auth_chunk *auth = NULL;
+	uint32_t auth_offset;
+	struct sctp_auth_chunk *auth;
 	uint16_t auth_keyid;
 	int override_ok = 1;
 	int skip_fill_up = 0;
@@ -8068,6 +8068,8 @@ again_one_more_time:
 		}
 		bundle_at = 0;
 		endoutchain = outchain = NULL;
+		auth = NULL;
+		auth_offset = 0;
 		no_fragmentflg = 1;
 		one_chunk = 0;
 		if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {


More information about the svn-src-all mailing list