Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 15 Aug 2013 04:35:26 +0000 (UTC)
From:      Michael Tuexen <tuexen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org
Subject:   svn commit: r254354 - stable/8/sys/netinet
Message-ID:  <201308150435.r7F4ZQGL037358@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: tuexen
Date: Thu Aug 15 04:35:25 2013
New Revision: 254354
URL: http://svnweb.freebsd.org/changeset/base/254354

Log:
  MFC r254338:
  
  Don't send uninitialized memory (two instances of 4 bytes) in
  every cookie on the wire. This bug was reported in
  https://bugzilla.mozilla.org/show_bug.cgi?id=905080

Modified:
  stable/8/sys/netinet/sctp_output.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/netinet/   (props changed)

Modified: stable/8/sys/netinet/sctp_output.c
==============================================================================
--- stable/8/sys/netinet/sctp_output.c	Thu Aug 15 04:27:10 2013	(r254353)
+++ stable/8/sys/netinet/sctp_output.c	Thu Aug 15 04:35:25 2013	(r254354)
@@ -5415,6 +5415,14 @@ do_a_abort:
 	}
 	SCTP_BUF_LEN(m) = sizeof(struct sctp_init_chunk);
 
+	/*
+	 * We might not overwrite the identification[] completely and on
+	 * some platforms time_entered will contain some padding. Therefore
+	 * zero out the cookie to avoid putting uninitialized memory on the
+	 * wire.
+	 */
+	memset(&stc, 0, sizeof(struct sctp_state_cookie));
+
 	/* the time I built cookie */
 	(void)SCTP_GETTIME_TIMEVAL(&stc.time_entered);
 



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201308150435.r7F4ZQGL037358>