Chronological Thread 

< Chronological >      < Thread >

---

On Apr 27, 2012, at 1:10 PM, Nils Olav Selåsdal - Utel Systems wrote:

> Hi,
> We got into an infinite loop just now, ch_enterPRSCTPfromInit() got stuck
> with pLen being 0 in this loop,
>
> while (curs < vlp_totalLength) {
> ack_string = &((SCTP_init
> *)chunks[initAckCID])->variableParams[writeCursor[initAckCID]];
> vl_initPtr = (SCTP_vlparam_header *) & init_string[curs];
> pType = ntohs(vl_initPtr->param_type);
> pLen = ntohs(vl_initPtr->param_length);
>
> if (pLen < 4) result = -1; /* peer error - ignore - should send an
> error notification */
>
> event_logiii(VERBOSE, "Scan variable parameters: Got type %u, len:
> %u, position %u",pType, pLen, curs);
>
> if (pType == VLPARAM_PRSCTP) {
> /* ha, we got one ! */
>
> if (pLen == 4) result = 0; /* peer supports it, but doesn't send
> anything unreliably */
> if (pLen > 4) result = 1; /* peer supports it, and does send
> some */
> memcpy(ack_string, vl_initPtr, pLen);
> writeCursor[initAckCID] += pLen;
> }
> curs += pLen;
> while ((curs % 4) != 0) curs++;
> }
>
>
> I’d assume it’ll be safe to change if (pLen < 4) result = -1; to if(pLen <
> 4) return -1; here ?
That seems correct. However, checking for pLen > 4 seems suspicious. I guess
the sctplib implements
some draft version, not PR-SCTP as specified in RFC 3758.

Best regards
Michael
>
> _______________________________________________
> sctp-discussion mailing list
> sctp-discussion AT sctp.de
> http://www.sctp.de/mailman/listinfo/sctp-discussion

---

• [SCTP-Discussion] ch_enterPRSCTPfromInit infinite loop., Nils Olav Selåsdal - Utel Systems, 04/27/2012
  • Re: [SCTP-Discussion] ch_enterPRSCTPfromInit infinite loop., Michael Tuexen, 04/27/2012

---

Archive powered by MHonArc 2.6.19+.