Improve detecting of illegal combinations in received data chunks.
Abort the association if there are data chunks with larger
fragement sequence numbers than the fragement sequence of the last
fragment.
Thanks to Mark Wodrich from Google who found this issue by fuzz testing
the userland stack and reporting this issue in
https://github.com/sctplab/usrsctp/issues/355
diff --git a/usrsctplib/netinet/sctp_indata.c b/usrsctplib/netinet/sctp_indata.c
index de18d7a..68b36f7 100755
--- a/usrsctplib/netinet/sctp_indata.c
+++ b/usrsctplib/netinet/sctp_indata.c
@@ -34,7 +34,7 @@
#ifdef __FreeBSD__
#include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_indata.c 350216 2019-07-22 18:11:35Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_indata.c 351638 2019-08-31 08:18:49Z tuexen $");
#endif
#include <netinet/sctp_os.h>
@@ -1479,6 +1479,16 @@
"The last fsn is now in place fsn: %u\n",
chk->rec.data.fsn);
control->last_frag_seen = 1;
+ if (SCTP_TSN_GT(control->top_fsn, chk->rec.data.fsn)) {
+ SCTPDBG(SCTP_DEBUG_XXX,
+ "New fsn: %u is not at top_fsn: %u -- abort\n",
+ chk->rec.data.fsn,
+ control->top_fsn);
+ sctp_abort_in_reasm(stcb, control, chk,
+ abort_flag,
+ SCTP_FROM_SCTP_INDATA + SCTP_LOC_9);
+ return;
+ }
}
if (asoc->idata_supported || control->first_frag_seen) {
/*
@@ -1491,7 +1501,7 @@
/* We have already delivered up to this so its a dup */
sctp_abort_in_reasm(stcb, control, chk,
abort_flag,
- SCTP_FROM_SCTP_INDATA + SCTP_LOC_9);
+ SCTP_FROM_SCTP_INDATA + SCTP_LOC_10);
return;
}
}
@@ -1503,7 +1513,7 @@
chk->rec.data.fsn, control->top_fsn);
sctp_abort_in_reasm(stcb, control,
chk, abort_flag,
- SCTP_FROM_SCTP_INDATA + SCTP_LOC_10);
+ SCTP_FROM_SCTP_INDATA + SCTP_LOC_11);
return;
}
if (asoc->idata_supported || control->first_frag_seen) {
@@ -1521,7 +1531,7 @@
chk->rec.data.fsn, control->fsn_included);
sctp_abort_in_reasm(stcb, control, chk,
abort_flag,
- SCTP_FROM_SCTP_INDATA + SCTP_LOC_11);
+ SCTP_FROM_SCTP_INDATA + SCTP_LOC_12);
return;
}
}
@@ -1533,7 +1543,7 @@
control->top_fsn);
sctp_abort_in_reasm(stcb, control, chk,
abort_flag,
- SCTP_FROM_SCTP_INDATA + SCTP_LOC_12);
+ SCTP_FROM_SCTP_INDATA + SCTP_LOC_13);
return;
}
}
@@ -1573,7 +1583,7 @@
at->rec.data.fsn);
sctp_abort_in_reasm(stcb, control,
chk, abort_flag,
- SCTP_FROM_SCTP_INDATA + SCTP_LOC_13);
+ SCTP_FROM_SCTP_INDATA + SCTP_LOC_14);
return;
}
}
