diff options
Diffstat (limited to 'include/net/sctp/sctp.h')
-rw-r--r-- | include/net/sctp/sctp.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h index ce13cf20f625..d33b17ba51d2 100644 --- a/include/net/sctp/sctp.h +++ b/include/net/sctp/sctp.h | |||
@@ -444,6 +444,8 @@ _sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member) | |||
444 | 444 | ||
445 | #define _sctp_walk_params(pos, chunk, end, member)\ | 445 | #define _sctp_walk_params(pos, chunk, end, member)\ |
446 | for (pos.v = chunk->member;\ | 446 | for (pos.v = chunk->member;\ |
447 | (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\ | ||
448 | (void *)chunk + end) &&\ | ||
447 | pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\ | 449 | pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\ |
448 | ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\ | 450 | ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\ |
449 | pos.v += WORD_ROUND(ntohs(pos.p->length))) | 451 | pos.v += WORD_ROUND(ntohs(pos.p->length))) |
@@ -454,6 +456,8 @@ _sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length)) | |||
454 | #define _sctp_walk_errors(err, chunk_hdr, end)\ | 456 | #define _sctp_walk_errors(err, chunk_hdr, end)\ |
455 | for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \ | 457 | for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \ |
456 | sizeof(sctp_chunkhdr_t));\ | 458 | sizeof(sctp_chunkhdr_t));\ |
459 | ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <=\ | ||
460 | (void *)chunk_hdr + end) &&\ | ||
457 | (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\ | 461 | (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\ |
458 | ntohs(err->length) >= sizeof(sctp_errhdr_t); \ | 462 | ntohs(err->length) >= sizeof(sctp_errhdr_t); \ |
459 | err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length)))) | 463 | err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length)))) |