Avoid underflowing a variable, which would result in taking more
data from the stream queues then needed.
Thanks to Timo Voelker for finding this bug and providing a fix.
#ifdef __FreeBSD__
#include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_output.c 360662 2020-05-05 17:52:44Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_output.c 360671 2020-05-05 19:54:30Z tuexen $");
#endif
#include <netinet/sctp_os.h>
@@ -8276,7 +8276,11 @@ sctp_fill_outqueue(struct sctp_tcb *stcb,
}
strq = stcb->asoc.ss_functions.sctp_ss_select_stream(stcb, net, asoc);
total_moved += moved;
+ if (space_left >= moved) {
space_left -= moved;
+ } else {
+ space_left = 0;
+ }
if (space_left >= SCTP_DATA_CHUNK_OVERHEAD(stcb)) {
space_left -= SCTP_DATA_CHUNK_OVERHEAD(stcb);
} else {
