svn commit: r353563 - stable/12/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Tue Oct 15 14:48:00 2019
New Revision: 353563
URL: https://svnweb.freebsd.org/changeset/base/353563

Log:
  MFC r353452:
  
  Ensure that local variables are reset to their initial value when
  dealing with error cases in a loop over all remote addresses.
  This issue was found and reported by OSS_Fuzz in:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18080
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18086
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18121
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18163

Modified:
  stable/12/sys/netinet/sctp_output.c

Modified: stable/12/sys/netinet/sctp_output.c
==============================================================================
--- stable/12/sys/netinet/sctp_output.c	Tue Oct 15 14:45:33 2019	(r353562)
+++ stable/12/sys/netinet/sctp_output.c	Tue Oct 15 14:48:00 2019	(r353563)
@@ -7872,8 +7872,8 @@ sctp_med_chunk_output(struct sctp_inpcb *inp,
 	int bundle_at, ctl_cnt, no_data_chunks, eeor_mode;
 	unsigned int mtu, r_mtu, omtu, mx_mtu, to_out;
 	int tsns_sent = 0;
-	uint32_t auth_offset = 0;
-	struct sctp_auth_chunk *auth = NULL;
+	uint32_t auth_offset;
+	struct sctp_auth_chunk *auth;
 	uint16_t auth_keyid;
 	int override_ok = 1;
 	int skip_fill_up = 0;
@@ -8068,6 +8068,8 @@ again_one_more_time:
 		}
 		bundle_at = 0;
 		endoutchain = outchain = NULL;
+		auth = NULL;
+		auth_offset = 0;
 		no_fragmentflg = 1;
 		one_chunk = 0;
 		if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {