If FWD-TSN chunk is received with bad stream ID, the sctp will not do the validity check, this may cause memory overflow when overwrite the TSN of the stream ID. The FORWARD-TSN chunk is like this: FORWARD-TSN chunk Type = 192 Flags = 0 Length = 172 NewTSN = 99 Stream = 10000 StreamSequence = 0xFFFF This patch fix this problem by skip the stream ID which not less than MIS. Signed-off-by: Wei Yongjun <yjwei@xxxxxxxxxxxxxx> --- net/sctp/ulpqueue.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c index 7b23803..dacdc3b 100644 --- a/net/sctp/ulpqueue.c +++ b/net/sctp/ulpqueue.c @@ -940,7 +940,10 @@ void sctp_ulpq_skip(struct sctp_ulpq *ulpq, __u16 sid, __u16 ssn) { struct sctp_stream *in; - /* Note: The stream ID must be verified before this routine. */ + /* Skip the stream ID which larger than MIS */ + if (sid >= ulpq->asoc->c.sinit_max_instreams) + return; + in = &ulpq->asoc->ssnmap->in; /* Is this an old SSN? If so ignore. */ -- 1.6.0.2.530.g67faa -- To unsubscribe from this list: send the line "unsubscribe linux-sctp" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html