svn commit: r352886 - releng/12.1/sys/netinet
Michael Tuexen
tuexen at FreeBSD.org
Mon Sep 30 04:54:03 UTC 2019
Author: tuexen
Date: Mon Sep 30 04:54:02 2019
New Revision: 352886
URL: https://svnweb.freebsd.org/changeset/base/352886
Log:
MFS r352508:
Don't write to memory outside of the allocated array for SACK blocks.
PR: 240837
Approved by: re (delphij@)
Obtained from: rrs@
Sponsored by: Netflix, Inc.
Modified:
releng/12.1/sys/netinet/tcp_sack.c
Directory Properties:
releng/12.1/ (props changed)
Modified: releng/12.1/sys/netinet/tcp_sack.c
==============================================================================
--- releng/12.1/sys/netinet/tcp_sack.c Mon Sep 30 03:35:48 2019 (r352885)
+++ releng/12.1/sys/netinet/tcp_sack.c Mon Sep 30 04:54:02 2019 (r352886)
@@ -235,7 +235,7 @@ tcp_update_dsack_list(struct tcpcb *tp, tcp_seq rcv_st
saved_blks[n].start = mid_blk.start;
saved_blks[n++].end = mid_blk.end;
}
- for (j = 0; (j < tp->rcv_numsacks) && (j < MAX_SACK_BLKS-1); j++) {
+ for (j = 0; (j < tp->rcv_numsacks) && (n < MAX_SACK_BLKS); j++) {
if (((SEQ_LT(tp->sackblks[j].end, mid_blk.start) ||
SEQ_GT(tp->sackblks[j].start, mid_blk.end)) &&
(SEQ_GT(tp->sackblks[j].start, tp->rcv_nxt))))
More information about the svn-src-releng
mailing list