[kernel] r12580 - dists/sid/linux-2.6/debian/patches/bugfix/all

[Dann Frazier]

Author: dannf
Date: Tue Jan 20 01:18:19 2009
New Revision: 12580

Log:
was applying to wrong function, fixed

Modified:
   dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-avoid-memory-overflow.patch

Modified: dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-avoid-memory-overflow.patch
==============================================================================
--- dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-avoid-memory-overflow.patch	(original)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-avoid-memory-overflow.patch	Tue Jan 20 01:18:19 2009
@@ -28,8 +28,8 @@
 Adjusted to apply to Debian's 2.6.26 by dann frazier <dannf at debian.org>
 
 diff -urpN linux-source-2.6.26.orig/net/sctp/sm_statefuns.c linux-source-2.6.26/net/sctp/sm_statefuns.c
---- linux-source-2.6.26.orig/net/sctp/sm_statefuns.c	2009-01-08 16:43:13.000000000 -0700
-+++ linux-source-2.6.26/net/sctp/sm_statefuns.c	2009-01-10 10:15:32.000000000 -0700
+--- linux-source-2.6.26.orig/net/sctp/sm_statefuns.c	2009-01-10 05:42:12.000000000 -0700
++++ linux-source-2.6.26/net/sctp/sm_statefuns.c	2009-01-19 16:37:09.000000000 -0700
 @@ -3641,6 +3641,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(c
  {
  	struct sctp_chunk *chunk = arg;
@@ -38,7 +38,20 @@
  	__u16 len;
  	__u32 tsn;
  
-@@ -3701,6 +3702,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_f
+@@ -3670,6 +3671,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(c
+ 	if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
+ 		goto discard_noforce;
+ 
++	/* Silently discard the chunk if stream-id is not valid */
++	sctp_walk_fwdtsn(skip, chunk) {
++		if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
++			goto discard_noforce;
++	}
++
+ 	sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
+ 	if (len > sizeof(struct sctp_fwdtsn_hdr))
+ 		sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
+@@ -3701,6 +3708,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_f
  {
  	struct sctp_chunk *chunk = arg;
  	struct sctp_fwdtsn_hdr *fwdtsn_hdr;
@@ -46,19 +59,13 @@
  	__u16 len;
  	__u32 tsn;
  
-@@ -3730,6 +3732,18 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_f
+@@ -3730,6 +3738,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_f
  	if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
  		goto gen_shutdown;
  
 +	/* Silently discard the chunk if stream-id is not valid */
 +	sctp_walk_fwdtsn(skip, chunk) {
 +		if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
-+			goto discard_noforce;
-+	}
-+
-+	/* Silently discard the chunk if stream-id is not valid */
-+	sctp_walk_fwdtsn(skip, chunk) {
-+		if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
 +			goto gen_shutdown;
 +	}
 +