diff options
| author | HanQuan <eilaimemedsnaimel@gmail.com> | 2026-07-13 03:20:21 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-07-21 12:30:38 -0700 |
| commit | ff04b26794a16a8a879eb4fd2c02c2d6b03850e9 (patch) | |
| tree | 7a9b3048c9250ddb64e843de9b38146f21404923 /tools/perf/scripts/python | |
| parent | ecaa37826340520664a4e5522f803ff48fc3f564 (diff) | |
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the
capacity limit for ep->auth_chunk_list, allowing it to hold up to
20 chunk entries (param_hdr.length up to 24). However, the copy
destination asoc->c.auth_chunks in struct sctp_cookie is only
SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16
chunks are added, sctp_association_init() memcpy overflows the
destination by up to 4 bytes.
Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching
the destination capacity.
Fixes: 1f485649f529 ("[SCTP]: Implement SCTP-AUTH internals")
Signed-off-by: HanQuan <eilaimemedsnaimel@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20260713032021.3491702-1-zhoujian.zja@antgroup.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions