svn commit: r352508 - stable/12/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Thu Sep 19 09:59:37 2019
New Revision: 352508
URL: https://svnweb.freebsd.org/changeset/base/352508

Log:
  MFC r352386:
  Don't write to memory outside of the allocated array for SACK blocks.
  
  Obtained from:		rrs@
  Sponsored by:		Netflix, Inc.

Modified:
  stable/12/sys/netinet/tcp_sack.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/tcp_sack.c
==============================================================================
--- stable/12/sys/netinet/tcp_sack.c	Thu Sep 19 09:48:01 2019	(r352507)
+++ stable/12/sys/netinet/tcp_sack.c	Thu Sep 19 09:59:37 2019	(r352508)
@@ -235,7 +235,7 @@ tcp_update_dsack_list(struct tcpcb *tp, tcp_seq rcv_st
 		saved_blks[n].start = mid_blk.start;
 		saved_blks[n++].end = mid_blk.end;
 	}
-	for (j = 0; (j < tp->rcv_numsacks) && (j < MAX_SACK_BLKS-1); j++) {
+	for (j = 0; (j < tp->rcv_numsacks) && (n < MAX_SACK_BLKS); j++) {
 		if (((SEQ_LT(tp->sackblks[j].end, mid_blk.start) ||
 		      SEQ_GT(tp->sackblks[j].start, mid_blk.end)) &&
 		    (SEQ_GT(tp->sackblks[j].start, tp->rcv_nxt))))