D18366.id51430.diff
No OneTemporary
Actions

Size

847 B

Referenced Files

None

Subscribers

None

D18366.id51430.diff
View Options

	Index: head/sys/netinet/cc/cc.h
	===================================================================
	--- head/sys/netinet/cc/cc.h
	+++ head/sys/netinet/cc/cc.h
	@@ -184,4 +184,6 @@
	#define CC_LIST_WUNLOCK() rw_wunlock(&cc_list_lock)
	#define CC_LIST_LOCK_ASSERT() rw_assert(&cc_list_lock, RA_LOCKED)

	+#define CC_ALGOOPT_LIMIT 2048
	+
	#endif /* _NETINET_CC_CC_H_ */
	Index: head/sys/netinet/tcp_usrreq.c
	===================================================================
	--- head/sys/netinet/tcp_usrreq.c
	+++ head/sys/netinet/tcp_usrreq.c
	@@ -1769,6 +1769,8 @@
	switch (sopt->sopt_name) {
	case TCP_CCALGOOPT:
	INP_WUNLOCK(inp);
	+ if (sopt->sopt_valsize > CC_ALGOOPT_LIMIT)
	+ return (EINVAL);
	pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK \| M_ZERO);
	error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,
	sopt->sopt_valsize);