diff options
| author | Patrick McHardy <kaber@trash.net> | 2006-03-13 05:34:53 +0100 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-03-13 05:39:39 +0100 |
| commit | 4a1ff6e2bde56cdf176bd54d557b2e15e819f810 (patch) | |
| tree | c831cb72a76e69b3e781f070c510a59b06e39cb9 /net | |
| parent | [NETLINK]: Fix use-after-free in netlink_recvmsg (diff) | |
| download | linux-4a1ff6e2bde56cdf176bd54d557b2e15e819f810.tar.xz linux-4a1ff6e2bde56cdf176bd54d557b2e15e819f810.zip | |
[TCP]: tcp_highspeed: fix AIMD table out-of-bounds access
Covertiy #547
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/tcp_highspeed.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c index 63cf7e540847..e0e9d1383c7c 100644 --- a/net/ipv4/tcp_highspeed.c +++ b/net/ipv4/tcp_highspeed.c @@ -125,7 +125,7 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt, /* Update AIMD parameters */ if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) { while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd && - ca->ai < HSTCP_AIMD_MAX) + ca->ai < HSTCP_AIMD_MAX - 1) ca->ai++; } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) { while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd && |