[NETFILTER]: Fix endless loop in SCTP conntrack When a chunk length is zero, for_each_sctp_chunk() doesn't make any forward progress and loops forever. A chunk length of 0 is invalid, so just abort in that case. Reported by Ingo Molnar . Signed-off-by: Patrick McHardy --- commit 32491b3d62bc8c3ff2400deebd46972ebc7332af tree 7249133ec32c18f4e6f989560e8d86b5e2e2cf0c parent 462f3ddd384045c731b3268a1b9c91c834a5a68a author Patrick McHardy Tue, 02 May 2006 15:44:30 +0200 committer Patrick McHardy Tue, 02 May 2006 15:44:30 +0200 net/ipv4/netfilter/ip_conntrack_proto_sctp.c | 4 ++-- net/netfilter/nf_conntrack_proto_sctp.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c index 5259abd..ebd4ecf 100644 --- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c +++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c @@ -209,8 +209,8 @@ static int sctp_print_conntrack(struct s #define for_each_sctp_chunk(skb, sch, _sch, offset, count) \ for (offset = skb->nh.iph->ihl * 4 + sizeof(sctp_sctphdr_t), count = 0; \ offset < skb->len && \ - (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch)); \ - offset += (htons(sch->length) + 3) & ~3, count++) + (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch)) && \ + sch->length; offset += (htons(sch->length) + 3) & ~3, count++) /* Some validity checks to make sure the chunks are fine */ static int do_basic_checks(struct ip_conntrack *conntrack, diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c index 9cccc32..2e34436 100644 --- a/net/netfilter/nf_conntrack_proto_sctp.c +++ b/net/netfilter/nf_conntrack_proto_sctp.c @@ -213,8 +213,8 @@ static int sctp_print_conntrack(struct s #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count) \ for (offset = dataoff + sizeof(sctp_sctphdr_t), count = 0; \ offset < skb->len && \ - (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch)); \ - offset += (htons(sch->length) + 3) & ~3, count++) + (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch)) && \ + sch->length; offset += (htons(sch->length) + 3) & ~3, count++) /* Some validity checks to make sure the chunks are fine */ static int do_basic_checks(struct nf_conn *conntrack,