Source code
Revision control
Copy as Markdown
Other Tools
diff --git a/netinet/sctp_indata.c b/netinet/sctp_indata.c
--- a/netinet/sctp_indata.c
+++ b/netinet/sctp_indata.c
@@ -315,6 +315,14 @@
return;
}
SCTP_CALC_TSN_TO_GAP(gap, tsn, asoc->mapping_array_base_tsn);
+ if (gap >= (uint32_t)(asoc->mapping_array_size << 3)) {
+ /*
+ * The TSN falls outside the mapping window, e.g. a control
+ * queued before a large FORWARD-TSN moved the window past it.
+ * It has no bit in either map, so there is nothing to mark.
+ */
+ return;
+ }
in_r = SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap);
in_nr = SCTP_IS_TSN_PRESENT(asoc->nr_mapping_array, gap);
KASSERT(in_r || in_nr, ("%s: Things are really messed up now", __func__));