Attachment #90547 for bug #138617




 * there is room for a param header too.
 */
#define sctp_walk_params(pos, chunk, member)\
_sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)

#define _sctp_walk_params(pos, chunk, end, member)\
for (pos.v = chunk->member;\
     pos.v <= (void *)chunk + end - sizeof(sctp_paramhdr_t) &&\
     pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
     ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
     pos.v += WORD_ROUND(ntohs(pos.p->length)))


for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
	    sizeof(sctp_chunkhdr_t));\
     (void *)err <= (void *)chunk_hdr + end - sizeof(sctp_errhdr_t) &&\
     (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
     ntohs(err->length) >= sizeof(sctp_errhdr_t); \
     err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length))))


Return to bug 138617

Lines 466-477 Link Here

(-)linux-2.4.33-rc1/include/net/sctp/sctp.h (-3 / +3 lines)
466	* there is room for a param header too.	466	* there is room for a param header too.
467	*/	467	*/
468	#define sctp_walk_params(pos, chunk, member)\	468	#define sctp_walk_params(pos, chunk, member)\
469	_sctp_walk_params((pos), (chunk), WORD_ROUND(ntohs((chunk)->chunk_hdr.length)), member)	469	_sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)
470		470
471	#define _sctp_walk_params(pos, chunk, end, member)\	471	#define _sctp_walk_params(pos, chunk, end, member)\
472	for (pos.v = chunk->member;\	472	for (pos.v = chunk->member;\
473	pos.v <= (void *)chunk + end - sizeof(sctp_paramhdr_t) &&\	473	pos.v <= (void *)chunk + end - sizeof(sctp_paramhdr_t) &&\
474	pos.v <= (void *)chunk + end - WORD_ROUND(ntohs(pos.p->length)) &&\	474	pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
475	ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\	475	ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
476	pos.v += WORD_ROUND(ntohs(pos.p->length)))	476	pos.v += WORD_ROUND(ntohs(pos.p->length)))
477		477
Lines 482-488 Link Here
482	for (err = (sctp_errhdr_t )((void )chunk_hdr + \	482	for (err = (sctp_errhdr_t )((void )chunk_hdr + \
483	sizeof(sctp_chunkhdr_t));\	483	sizeof(sctp_chunkhdr_t));\
484	(void )err <= (void )chunk_hdr + end - sizeof(sctp_errhdr_t) &&\	484	(void )err <= (void )chunk_hdr + end - sizeof(sctp_errhdr_t) &&\
485	(void )err <= (void )chunk_hdr + end - WORD_ROUND(ntohs(err->length)) &&\	485	(void )err <= (void )chunk_hdr + end - ntohs(err->length) &&\
486	ntohs(err->length) >= sizeof(sctp_errhdr_t); \	486	ntohs(err->length) >= sizeof(sctp_errhdr_t); \
487	err = (sctp_errhdr_t )((void )err + WORD_ROUND(ntohs(err->length))))	487	err = (sctp_errhdr_t )((void )err + WORD_ROUND(ntohs(err->length))))
488		488