{"action":"opened","issue":{"url":"https://api.github.com/repos/sctplab/usrsctp/issues/182","repository_url":"https://api.github.com/repos/sctplab/usrsctp","labels_url":"https://api.github.com/repos/sctplab/usrsctp/issues/182/labels{/name}","comments_url":"https://api.github.com/repos/sctplab/usrsctp/issues/182/comments","events_url":"https://api.github.com/repos/sctplab/usrsctp/issues/182/events","html_url":"https://github.com/sctplab/usrsctp/issues/182","id":272870104,"number":182,"title":"segfault in recv_function_raw","user":{"login":"falkevik","id":169777,"avatar_url":"https://avatars2.githubusercontent.com/u/169777?v=4","gravatar_id":"","url":"https://api.github.com/users/falkevik","html_url":"https://github.com/falkevik","followers_url":"https://api.github.com/users/falkevik/followers","following_url":"https://api.github.com/users/falkevik/following{/other_user}","gists_url":"https://api.github.com/users/falkevik/gists{/gist_id}","starred_url":"https://api.github.com/users/falkevik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/falkevik/subscriptions","organizations_url":"https://api.github.com/users/falkevik/orgs","repos_url":"https://api.github.com/users/falkevik/repos","events_url":"https://api.github.com/users/falkevik/events{/privacy}","received_events_url":"https://api.github.com/users/falkevik/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-11-10T09:26:40Z","updated_at":"2017-11-10T09:26:40Z","closed_at":null,"author_association":"NONE","body":"In commit ea1d1d97 `ncounter` was changed from `signed` to `unsigned int` which can lead to segfault.\r\nShould we have signed int or change to `ncounter -= min(ncounter, iovlen);` in below code snippet?\r\n\r\n```\r\ndo {\r\n    recvmbuf[i]->m_next = recvmbuf[i+1];\r\n    SCTP_BUF_LEN(recvmbuf[i]->m_next) = min(ncounter, iovlen);\r\n    i++;\r\n    ncounter -= iovlen;\r\n    (to_fill)++;\r\n} while (ncounter > 0);\r\n```\r\n\r\n```\r\n[Switching to Thread 0x7fe41b7fe700 (LWP 7244)]\r\n0x00007fe438786c63 in recv_function_raw (arg=0x0) at user_recv_thread.c:368\r\n368\t\t\t\t\tSCTP_BUF_LEN(recvmbuf[i]->m_next) = min(ncounter, iovlen);\r\n(gdb) bt\r\n#0  0x00007fe438786c63 in recv_function_raw (arg=0x0) at user_recv_thread.c:368\r\n#1  0x00007fe47bcfc7fc in start_thread (arg=0x7fe41b7fe700) at pthread_create.c:465\r\n#2  0x00007fe47b821b0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95\r\n(gdb) p n\r\n$1 = 2448\r\n(gdb) p ncounter\r\n$2 = 4294904208\r\n\r\n```"}}
{"actor":{"display_login":"falkevik"}}