SCTP Discussions

Text archives Help


Re: [SCTP-Discussion] ch_enterPRSCTPfromInit infinite loop.


Chronological Thread 
  • From: Michael Tuexen <Michael.Tuexen AT micmac.franken.de>
  • To: Nils Olav Selåsdal - Utel Systems <nos AT utel.no>
  • Cc: "discussion AT sctp.de" <discussion AT sctp.de>
  • Subject: Re: [SCTP-Discussion] ch_enterPRSCTPfromInit infinite loop.
  • Date: Fri, 27 Apr 2012 15:25:07 +0200
  • List-archive: <http://lists.franken.de/pipermail/sctp-discussion>
  • List-id: SCTP Discussions <sctp-discussion.sctp.de>

On Apr 27, 2012, at 1:10 PM, Nils Olav Selåsdal - Utel Systems wrote:

> Hi,
> We got into an infinite loop just now, ch_enterPRSCTPfromInit() got stuck
> with pLen being 0 in this loop,
>
> while (curs < vlp_totalLength) {
> ack_string = &((SCTP_init
> *)chunks[initAckCID])->variableParams[writeCursor[initAckCID]];
> vl_initPtr = (SCTP_vlparam_header *) & init_string[curs];
> pType = ntohs(vl_initPtr->param_type);
> pLen = ntohs(vl_initPtr->param_length);
>
> if (pLen < 4) result = -1; /* peer error - ignore - should send an
> error notification */
>
> event_logiii(VERBOSE, "Scan variable parameters: Got type %u, len:
> %u, position %u",pType, pLen, curs);
>
> if (pType == VLPARAM_PRSCTP) {
> /* ha, we got one ! */
>
> if (pLen == 4) result = 0; /* peer supports it, but doesn't send
> anything unreliably */
> if (pLen > 4) result = 1; /* peer supports it, and does send
> some */
> memcpy(ack_string, vl_initPtr, pLen);
> writeCursor[initAckCID] += pLen;
> }
> curs += pLen;
> while ((curs % 4) != 0) curs++;
> }
>
>
> I’d assume it’ll be safe to change if (pLen < 4) result = -1; to if(pLen <
> 4) return -1; here ?
That seems correct. However, checking for pLen > 4 seems suspicious. I guess
the sctplib implements
some draft version, not PR-SCTP as specified in RFC 3758.

Best regards
Michael
>
> _______________________________________________
> sctp-discussion mailing list
> sctp-discussion AT sctp.de
> http://www.sctp.de/mailman/listinfo/sctp-discussion





Archive powered by MHonArc 2.6.19+.

Top of page