Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

[platform/kernel/linux-starfive.git] / net / sctp / input.c

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 76dcc13..02e7326 100644 (file)
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -1155,7 +1155,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
                if (!af)
                        continue;
 
-               af->from_addr_param(paddr, params.addr, sh->source, 0);
+               if (!af->from_addr_param(paddr, params.addr, sh->source, 0))
+                       continue;
 
                asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
                if (asoc)
@@ -1191,6 +1192,9 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
        union sctp_addr_param *param;
        union sctp_addr paddr;
 
+       if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr))
+               return NULL;
+
        /* Skip over the ADDIP header and find the Address parameter */
        param = (union sctp_addr_param *)(asconf + 1);
 
@@ -1198,7 +1202,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
        if (unlikely(!af))
                return NULL;
 
-       af->from_addr_param(&paddr, param, peer_port, 0);
+       if (af->from_addr_param(&paddr, param, peer_port, 0))
+               return NULL;
 
        return __sctp_lookup_association(net, laddr, &paddr, transportp);
 }
@@ -1269,7 +1274,7 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net,
 
                ch = (struct sctp_chunkhdr *)ch_end;
                chunk_num++;
-       } while (ch_end < skb_tail_pointer(skb));
+       } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
 
        return asoc;
 }