-
sctp
SCTP Discussions
Text archives Help
- From: Marcin Zawadzki <zaba.marcin AT gmail.com>
- To: sctp-discussion AT sctp.de
- Subject: [SCTP-Discussion] Buffer exceed question.
- Date: Thu, 18 Feb 2010 15:11:55 +0100
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=XG4chbMwouBA+BoE35bZt32Jxyo3k+x2UPkJIwCWDDfFPkPu2/DF7fyho3MOIyPh9C E8GtglqkOwGLHiyZ/X8+sTBgRMDk/TdhEsD83bkth6bKrajO4DymL88OlTxVLz+OJEaq vYpCFYM17894/gSwCHErrJ6xaHezZOb6zIPQA=
- List-archive: <http://lists.franken.de/pipermail/sctp-discussion>
- List-id: SCTP Discussions <sctp-discussion.sctp.de>
Hello.
I've bene analizing your coud and got one question:
Is it possible that in this function vl_param_curs index will exceed chunks[chunkID])->variableParams buffer?
void ch_enterCookiePreservative(ChunkID chunkID, unsigned int lifespanIncrement)
{
SCTP_cookie_preservative *preserv;
gint32 vl_param_curs;
guint16 vl_param_total_length;
if (chunks[chunkID] == NULL) {
error_log(ERROR_MAJOR, "Invalid chunk ID");
}
if (chunkCompleted[chunkID]) {
error_log(ERROR_MAJOR, "ch_enterCookiePreservative : chunk already completed");
return;
}
if (chunks[chunkID]->chunk_header.chunk_id == CHUNK_INIT) {
/* check if init chunk already contains a cookie preserv. */
vl_param_total_length =
((SCTP_init *) chunks[chunkID])->chunk_header.chunk_length -
sizeof(SCTP_chunk_header) - sizeof(SCTP_init_fixed);
vl_param_curs = retrieveVLParamFromString(VLPARAM_COOKIE_PRESERV, &((SCTP_init *)
chunks
[chunkID])->
variableParams[0], vl_param_total_length);
if (vl_param_curs >= 0) {
/* simply overwrite this cookie preserv. */
preserv = (SCTP_cookie_preservative *) & ((SCTP_init *)
chunks[chunkID])->variableParams
[vl_param_curs]; <--------------this line
} else {
/* append the new parameter */
preserv = (SCTP_cookie_preservative *) & ((SCTP_init *)
chunks[chunkID])->variableParams[writeCursor[chunkID]];
/* _might_ be overflow here, at some time... */
writeCursor[chunkID] += sizeof(SCTP_cookie_preservative);
}
/* enter cookie preservative */
preserv->vlparam_header.param_type = htons(VLPARAM_COOKIE_PRESERV);
preserv->vlparam_header.param_length = htons(sizeof(SCTP_cookie_preservative));
preserv->cookieLifetimeInc = htonl(lifespanIncrement);
} else {
error_log(ERROR_MAJOR, "ch_enterCookiePreservative: chunk type not init");
}
}
- [SCTP-Discussion] Buffer exceed question., Marcin Zawadzki, 02/18/2010
Archive powered by MHonArc 2.6.19+.
