Fix length check for ECNE chunks.
This fixes
@@ -3315,10 +3315,6 @@ sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
unsigned int pkt_cnt;
len = ntohs(cp->ch.chunk_length);
- if ((len != sizeof(struct sctp_ecne_chunk)) &&
- (len != sizeof(struct old_sctp_ecne_chunk))) {
- return;
- }
if (len == sizeof(struct old_sctp_ecne_chunk)) {
/* Its the old format */
memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
@@ -5489,7 +5485,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
if (stcb->asoc.ecn_supported == 0) {
goto unknown_chunk;
}
- if (chk_length != sizeof(struct sctp_ecne_chunk)) {
+ if ((chk_length != sizeof(struct sctp_ecne_chunk)) &&
+ (chk_length != sizeof(struct old_sctp_ecne_chunk))) {
break;
}
sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch, stcb);
