svn commit: r352886 - releng/12.1/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Mon Sep 30 04:54:02 2019
New Revision: 352886
URL: https://svnweb.freebsd.org/changeset/base/352886

Log:
  MFS r352508:
  Don't write to memory outside of the allocated array for SACK blocks.
  
  PR:			240837
  Approved by:		re (delphij@)
  Obtained from:		rrs@
  Sponsored by:		Netflix, Inc.

Modified:
  releng/12.1/sys/netinet/tcp_sack.c
Directory Properties:
  releng/12.1/   (props changed)

Modified: releng/12.1/sys/netinet/tcp_sack.c
==============================================================================
--- releng/12.1/sys/netinet/tcp_sack.c	Mon Sep 30 03:35:48 2019	(r352885)
+++ releng/12.1/sys/netinet/tcp_sack.c	Mon Sep 30 04:54:02 2019	(r352886)
@@ -235,7 +235,7 @@ tcp_update_dsack_list(struct tcpcb *tp, tcp_seq rcv_st
 		saved_blks[n].start = mid_blk.start;
 		saved_blks[n++].end = mid_blk.end;
 	}
-	for (j = 0; (j < tp->rcv_numsacks) && (j < MAX_SACK_BLKS-1); j++) {
+	for (j = 0; (j < tp->rcv_numsacks) && (n < MAX_SACK_BLKS); j++) {
 		if (((SEQ_LT(tp->sackblks[j].end, mid_blk.start) ||
 		      SEQ_GT(tp->sackblks[j].start, mid_blk.end)) &&
 		    (SEQ_GT(tp->sackblks[j].start, tp->rcv_nxt))))