-
sctp
SCTP Discussions
Text archives Help
- From: Nils Olav Selåsdal - Utel Systems <nos AT utel.no>
- To: "discussion AT sctp.de" <discussion AT sctp.de>
- Subject: [SCTP-Discussion] ch_enterPRSCTPfromInit infinite loop.
- Date: Fri, 27 Apr 2012 11:10:54 +0000
- Accept-language: nb-NO, en-US
- List-archive: <http://lists.franken.de/pipermail/sctp-discussion>
- List-id: SCTP Discussions <sctp-discussion.sctp.de>
Hi,
We got into an infinite loop just now, ch_enterPRSCTPfromInit() got stuck
with pLen being 0 in this loop,
while (curs < vlp_totalLength) {
ack_string = &((SCTP_init
*)chunks[initAckCID])->variableParams[writeCursor[initAckCID]];
vl_initPtr = (SCTP_vlparam_header *) & init_string[curs];
pType = ntohs(vl_initPtr->param_type);
pLen = ntohs(vl_initPtr->param_length);
if (pLen < 4) result = -1; /* peer error - ignore - should send an
error notification */
event_logiii(VERBOSE, "Scan variable parameters: Got type %u, len:
%u, position %u",pType, pLen, curs);
if (pType == VLPARAM_PRSCTP) {
/* ha, we got one ! */
if (pLen == 4) result = 0; /* peer supports it, but doesn't send
anything unreliably */
if (pLen > 4) result = 1; /* peer supports it, and does send
some */
memcpy(ack_string, vl_initPtr, pLen);
writeCursor[initAckCID] += pLen;
}
curs += pLen;
while ((curs % 4) != 0) curs++;
}
I’d assume it’ll be safe to change if (pLen < 4) result = -1; to if(pLen <
4) return -1; here ?
- [SCTP-Discussion] ch_enterPRSCTPfromInit infinite loop., Nils Olav Selåsdal - Utel Systems, 04/27/2012
- Re: [SCTP-Discussion] ch_enterPRSCTPfromInit infinite loop., Michael Tuexen, 04/27/2012
Archive powered by MHonArc 2.6.19+.
