Don't write to memory outside of the allocated array for SACK blocks.

Obtained from:		rrs@
MFC after:		3 days
Sponsored by:		Netflix, Inc.

diff --git a/sys/netinet/tcp_sack.c b/sys/netinet/tcp_sack.c
index 999fb4f5890b15fae788db05347f36aca40adaec..311a84b989a9490ea2be68e0792ba06d602a613b 100644 (file)
--- a/sys/netinet/tcp_sack.c
+++ b/sys/netinet/tcp_sack.c
@@ -235,7 +235,7 @@ tcp_update_dsack_list(struct tcpcb *tp, tcp_seq rcv_start, tcp_seq rcv_end)
                saved_blks[n].start = mid_blk.start;
                saved_blks[n++].end = mid_blk.end;
        }
-       for (j = 0; (j < tp->rcv_numsacks) && (j < MAX_SACK_BLKS-1); j++) {
+       for (j = 0; (j < tp->rcv_numsacks) && (n < MAX_SACK_BLKS); j++) {
                if (((SEQ_LT(tp->sackblks[j].end, mid_blk.start) ||
                      SEQ_GT(tp->sackblks[j].start, mid_blk.end)) &&
                    (SEQ_GT(tp->sackblks[j].start, tp->rcv_nxt))))