diff options
author | Stefan Agner <stefan.agner@toradex.com> | 2017-09-26 16:04:08 +0200 |
---|---|---|
committer | Stefan Agner <stefan.agner@toradex.com> | 2017-09-26 18:11:18 +0200 |
commit | 1f4d46cea2bc1886a13ae9adfcd9e4243eed6a4c (patch) | |
tree | 2001999c70f8e46b192fc552590810aab35710e3 /include/net/sctp/sctp.h | |
parent | d152ae9d4704d8c7b3775e3b1a20e62aa3b1eed8 (diff) | |
parent | b52c9082f2eb3a6f7fbbc86fad3eaa2a1725da66 (diff) |
Merge tag 'v4.4.88' into toradex_vf_4.4-next
This is the 4.4.88 stable release
Diffstat (limited to 'include/net/sctp/sctp.h')
-rw-r--r-- | include/net/sctp/sctp.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h index ce13cf20f625..d33b17ba51d2 100644 --- a/include/net/sctp/sctp.h +++ b/include/net/sctp/sctp.h @@ -444,6 +444,8 @@ _sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member) #define _sctp_walk_params(pos, chunk, end, member)\ for (pos.v = chunk->member;\ + (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\ + (void *)chunk + end) &&\ pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\ ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\ pos.v += WORD_ROUND(ntohs(pos.p->length))) @@ -454,6 +456,8 @@ _sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length)) #define _sctp_walk_errors(err, chunk_hdr, end)\ for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \ sizeof(sctp_chunkhdr_t));\ + ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <=\ + (void *)chunk_hdr + end) &&\ (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\ ntohs(err->length) >= sizeof(sctp_errhdr_t); \ err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length)))) |