summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2006-03-13 05:34:53 +0100
committerDavid S. Miller <davem@sunset.davemloft.net>2006-03-13 05:39:39 +0100
commit4a1ff6e2bde56cdf176bd54d557b2e15e819f810 (patch)
treec831cb72a76e69b3e781f070c510a59b06e39cb9 /net
parent[NETLINK]: Fix use-after-free in netlink_recvmsg (diff)
downloadlinux-4a1ff6e2bde56cdf176bd54d557b2e15e819f810.tar.xz
linux-4a1ff6e2bde56cdf176bd54d557b2e15e819f810.zip
[TCP]: tcp_highspeed: fix AIMD table out-of-bounds access
Covertiy #547 Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/tcp_highspeed.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index 63cf7e540847..e0e9d1383c7c 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -125,7 +125,7 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
/* Update AIMD parameters */
if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
- ca->ai < HSTCP_AIMD_MAX)
+ ca->ai < HSTCP_AIMD_MAX - 1)
ca->ai++;
} else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&