SCTP Discussions

Text archives Help


[SCTP-Discussion] ch_enterPRSCTPfromInit infinite loop.


Chronological Thread 
  • From: Nils Olav Selåsdal - Utel Systems <nos AT utel.no>
  • To: "discussion AT sctp.de" <discussion AT sctp.de>
  • Subject: [SCTP-Discussion] ch_enterPRSCTPfromInit infinite loop.
  • Date: Fri, 27 Apr 2012 11:10:54 +0000
  • Accept-language: nb-NO, en-US
  • List-archive: <http://lists.franken.de/pipermail/sctp-discussion>
  • List-id: SCTP Discussions <sctp-discussion.sctp.de>

Hi,
We got into an infinite loop just now, ch_enterPRSCTPfromInit() got stuck
with pLen being 0 in this loop,

while (curs < vlp_totalLength) {
ack_string = &((SCTP_init
*)chunks[initAckCID])->variableParams[writeCursor[initAckCID]];
vl_initPtr = (SCTP_vlparam_header *) & init_string[curs];
pType = ntohs(vl_initPtr->param_type);
pLen = ntohs(vl_initPtr->param_length);

if (pLen < 4) result = -1; /* peer error - ignore - should send an
error notification */

event_logiii(VERBOSE, "Scan variable parameters: Got type %u, len:
%u, position %u",pType, pLen, curs);

if (pType == VLPARAM_PRSCTP) {
/* ha, we got one ! */

if (pLen == 4) result = 0; /* peer supports it, but doesn't send
anything unreliably */
if (pLen > 4) result = 1; /* peer supports it, and does send
some */
memcpy(ack_string, vl_initPtr, pLen);
writeCursor[initAckCID] += pLen;
}
curs += pLen;
while ((curs % 4) != 0) curs++;
}


I’d assume it’ll be safe to change if (pLen < 4) result = -1; to if(pLen <
4) return -1; here ?




Archive powered by MHonArc 2.6.19+.

Top of page