svn commit: r345465 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Sun Mar 24 09:46:16 2019
New Revision: 345465
URL: https://svnweb.freebsd.org/changeset/base/345465

Log:
  Fix a signed/unsigned bug when receiving SCTP messages.
  This is joint work with rrs at .
  
  Reported by:		syzbot+6b8a4bc8cc828e9d9790 at syzkaller.appspotmail.com
  MFC after:		1 week

Modified:
  head/sys/netinet/sctputil.c

Modified: head/sys/netinet/sctputil.c
==============================================================================
--- head/sys/netinet/sctputil.c	Sun Mar 24 06:28:25 2019	(r345464)
+++ head/sys/netinet/sctputil.c	Sun Mar 24 09:46:16 2019	(r345465)
@@ -5219,8 +5219,9 @@ sctp_sorecvmsg(struct socket *so,
 	 *
 	 */
 	struct sctp_inpcb *inp = NULL;
-	int my_len = 0;
-	int cp_len = 0, error = 0;
+	size_t my_len = 0;
+	size_t cp_len = 0;
+	int error = 0;
 	struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
 	struct mbuf *m = NULL;
 	struct sctp_tcb *stcb = NULL;
@@ -5728,8 +5729,8 @@ get_more_data:
 		m = control->data;
 		while (m) {
 			/* Move out all we can */
-			cp_len = (int)uio->uio_resid;
-			my_len = (int)SCTP_BUF_LEN(m);
+			cp_len = uio->uio_resid;
+			my_len = SCTP_BUF_LEN(m);
 			if (cp_len > my_len) {
 				/* not enough in this buf */
 				cp_len = my_len;