SCTP Discussions

Text archives Help


[SCTP-Discussion] Buffer exceed question.


Chronological Thread 
  • From: Marcin Zawadzki <zaba.marcin AT gmail.com>
  • To: sctp-discussion AT sctp.de
  • Subject: [SCTP-Discussion] Buffer exceed question.
  • Date: Thu, 18 Feb 2010 15:11:55 +0100
  • Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=XG4chbMwouBA+BoE35bZt32Jxyo3k+x2UPkJIwCWDDfFPkPu2/DF7fyho3MOIyPh9C E8GtglqkOwGLHiyZ/X8+sTBgRMDk/TdhEsD83bkth6bKrajO4DymL88OlTxVLz+OJEaq vYpCFYM17894/gSwCHErrJ6xaHezZOb6zIPQA=
  • List-archive: <http://lists.franken.de/pipermail/sctp-discussion>
  • List-id: SCTP Discussions <sctp-discussion.sctp.de>

Hello.

I've bene analizing your coud and got one question:
Is it possible that in this function vl_param_curs index will exceed chunks[chunkID])->variableParams buffer?

void ch_enterCookiePreservative(ChunkID chunkID, unsigned int lifespanIncrement)
{
    SCTP_cookie_preservative *preserv;
    gint32 vl_param_curs;
    guint16 vl_param_total_length;

    if (chunks[chunkID] == NULL) {
        error_log(ERROR_MAJOR, "Invalid chunk ID");

    }

    if (chunkCompleted[chunkID]) {
        error_log(ERROR_MAJOR, "ch_enterCookiePreservative : chunk already completed");
        return;
    }

    if (chunks[chunkID]->chunk_header.chunk_id == CHUNK_INIT) {
        /* check if init chunk already contains a cookie preserv. */
        vl_param_total_length =
            ((SCTP_init *) chunks[chunkID])->chunk_header.chunk_length -
            sizeof(SCTP_chunk_header) - sizeof(SCTP_init_fixed);

        vl_param_curs = retrieveVLParamFromString(VLPARAM_COOKIE_PRESERV, &((SCTP_init *)
                                                                            chunks
                                                                            [chunkID])->
                                                  variableParams[0], vl_param_total_length);
        if (vl_param_curs >= 0) {
            /* simply overwrite this cookie preserv. */
            preserv = (SCTP_cookie_preservative *) & ((SCTP_init *)
                                                      chunks[chunkID])->variableParams
                [vl_param_curs];                                                                                             <--------------this line
        } else {
            /* append the new parameter */
            preserv = (SCTP_cookie_preservative *) & ((SCTP_init *)
                                 chunks[chunkID])->variableParams[writeCursor[chunkID]];
            /* _might_ be overflow here, at some time... */
            writeCursor[chunkID] += sizeof(SCTP_cookie_preservative);
        }

        /* enter cookie preservative */
        preserv->vlparam_header.param_type = htons(VLPARAM_COOKIE_PRESERV);
        preserv->vlparam_header.param_length = htons(sizeof(SCTP_cookie_preservative));
        preserv->cookieLifetimeInc = htonl(lifespanIncrement);

    } else {
        error_log(ERROR_MAJOR, "ch_enterCookiePreservative: chunk type not init");
    }
}



  • [SCTP-Discussion] Buffer exceed question., Marcin Zawadzki, 02/18/2010

Archive powered by MHonArc 2.6.19+.

Top of page