svn commit: r360772 - stable/11/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Thu May  7 03:50:34 2020
New Revision: 360772
URL: https://svnweb.freebsd.org/changeset/base/360772

Log:
  MFC r360671: Avoid integer underflow
  
  Avoid underflowing a variable, which would result in taking more
  data from the stream queues then needed.
  
  Thanks to Timo Voelker for finding this bug and providing a fix.

Modified:
  stable/11/sys/netinet/sctp_output.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet/sctp_output.c
==============================================================================
--- stable/11/sys/netinet/sctp_output.c	Thu May  7 03:48:59 2020	(r360771)
+++ stable/11/sys/netinet/sctp_output.c	Thu May  7 03:50:34 2020	(r360772)
@@ -7763,7 +7763,11 @@ sctp_fill_outqueue(struct sctp_tcb *stcb,
 		}
 		strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc);
 		total_moved += moved;
-		space_left -= moved;
+		if (space_left >= moved) {
+			space_left -= moved;
+		} else {
+			space_left = 0;
+		}
 		if (space_left >= SCTP_DATA_CHUNK_OVERHEAD(stcb)) {
 			space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb);
 		} else {