diff options
| author | Xin Long <lucien.xin@gmail.com> | 2017-07-14 16:07:33 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-07-14 18:05:10 +0200 |
| commit | 10b3bf54406bb7f4e78da9bb2a485c5c986678ad (patch) | |
| tree | 1fc6c65f13b73222d6730f22b6d1b0f3315ea467 /drivers/net/ethernet/broadcom/bgmac-platform.c | |
| parent | liquidio: fix possible eeprom format string overflow (diff) | |
| download | linux-10b3bf54406bb7f4e78da9bb2a485c5c986678ad.tar.xz linux-10b3bf54406bb7f4e78da9bb2a485c5c986678ad.zip | |
sctp: fix an array overflow when all ext chunks are set
Marcelo noticed an array overflow caused by commit c28445c3cb07
("sctp: add reconf_enable in asoc ep and netns"), in which sctp
would add SCTP_CID_RECONF into extensions when reconf_enable is
set in sctp_make_init and sctp_make_init_ack.
Then now when all ext chunks are set, 4 ext chunk ids can be put
into extensions array while extensions array size is 3. It would
cause a kernel panic because of this overflow.
This patch is to fix it by defining extensions array size is 4 in
both sctp_make_init and sctp_make_init_ack.
Fixes: c28445c3cb07 ("sctp: add reconf_enable in asoc ep and netns")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/broadcom/bgmac-platform.c')
0 files changed, 0 insertions, 0 deletions