summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--devtools/client/shared/curl.js38
-rw-r--r--dom/base/nsFocusManager.cpp9
-rw-r--r--embedding/components/windowwatcher/nsWindowWatcher.cpp6
-rw-r--r--js/src/jit/Ion.cpp8
-rw-r--r--js/src/jit/IonAnalysis.cpp268
-rw-r--r--js/src/jit/IonAnalysis.h3
-rw-r--r--js/src/jit/Lowering.cpp11
-rw-r--r--js/src/jit/MIR.h10
-rw-r--r--js/src/vm/CommonPropertyNames.h6
-rwxr-xr-xnetwerk/sctp/src/netinet/sctp.h7
-rwxr-xr-xnetwerk/sctp/src/netinet/sctp_auth.c5
-rwxr-xr-xnetwerk/sctp/src/netinet/sctp_pcb.c7
-rwxr-xr-xnetwerk/sctp/src/netinet/sctp_usrreq.c14
13 files changed, 68 insertions, 324 deletions
diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js
index 967019746..d9abf506a 100644
--- a/devtools/client/shared/curl.js
+++ b/devtools/client/shared/curl.js
@@ -58,9 +58,21 @@ const Curl = {
* A cURL command.
*/
generateCommand: function (data) {
- let utils = CurlUtils;
+ const utils = CurlUtils;
let command = ["curl"];
+
+ // Make sure to use the following helpers to sanitize arguments before execution.
+ const addParam = value => {
+ const safe = /^[a-zA-Z-]+$/.test(value) ? value : escapeString(value);
+ command.push(safe);
+ };
+
+ const addPostData = value => {
+ const safe = /^[a-zA-Z-]+$/.test(value) ? value : escapeString(value);
+ postData.push(safe);
+ };
+
let ignoredHeaders = new Set();
// The cURL command is expected to run on the same platform that Firefox runs
@@ -69,7 +81,7 @@ const Curl = {
utils.escapeStringWin : utils.escapeStringPosix;
// Add URL.
- command.push(escapeString(data.url));
+ addParam(data.url);
let postDataText = null;
let multipartRequest = utils.isMultipartRequest(data);
@@ -79,15 +91,15 @@ const Curl = {
if (utils.isUrlEncodedRequest(data) ||
["PUT", "POST", "PATCH"].includes(data.method)) {
postDataText = data.postDataText;
- postData.push("--data");
- postData.push(escapeString(utils.writePostDataTextParams(postDataText)));
+ addPostData("--data");
+ addPostData(utils.writePostDataTextParams(postDataText));
ignoredHeaders.add("content-length");
} else if (multipartRequest) {
postDataText = data.postDataText;
- postData.push("--data-binary");
+ addPostData("--data-binary");
let boundary = utils.getMultipartBoundary(data);
let text = utils.removeBinaryDataFromMultipartText(postDataText, boundary);
- postData.push(escapeString(text));
+ addPostData(text);
ignoredHeaders.add("content-length");
}
@@ -95,15 +107,15 @@ const Curl = {
// For GET and POST requests this is not necessary as GET is the
// default. If --data or --binary is added POST is the default.
if (!(data.method == "GET" || data.method == "POST")) {
- command.push("-X");
- command.push(data.method);
+ addParam("-X");
+ addParam(data.method);
}
// Add -I (HEAD)
// For servers that supports HEAD.
// This will fetch the header of a document only.
if (data.method == "HEAD") {
- command.push("-I");
+ addParam("-I");
}
// Add http version.
@@ -114,7 +126,7 @@ const Curl = {
// data.httpVersion are HTTP/1.0, HTTP/1.1 and HTTP/2.0
// So in case of HTTP/2.0 (which should ideally be HTTP/2) we are using
// only major version, and full version in other cases
- command.push("--http" + (version == "2.0" ? version.split(".")[0] : version));
+ addParam("--http" + (version == "2.0" ? version.split(".")[0] : version));
}
// Add request headers.
@@ -126,14 +138,14 @@ const Curl = {
for (let i = 0; i < headers.length; i++) {
let header = headers[i];
if (header.name.toLowerCase() === "accept-encoding") {
- command.push("--compressed");
+ addParam("--compressed");
continue;
}
if (ignoredHeaders.has(header.name.toLowerCase())) {
continue;
}
- command.push("-H");
- command.push(escapeString(header.name + ": " + header.value));
+ addParam("-H");
+ addParam(header.name + ": " + header.value);
}
// Add post data.
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index fb350fa12..01c1944be 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -1261,6 +1261,15 @@ nsFocusManager::SetFocusInner(nsIContent* aNewContent, int32_t aFlags,
isElementInActiveWindow = (mActiveWindow && newRootWindow == mActiveWindow);
}
+ // Exit fullscreen if a website focuses another window
+ if (!isElementInActiveWindow && aFlags & FLAG_RAISE) {
+ if (nsIDocument* doc = mActiveWindow ? mActiveWindow->GetDoc() : nullptr) {
+ if (doc && doc->GetFullscreenElement()) {
+ nsIDocument::AsyncExitFullscreen(doc);
+ }
+ }
+ }
+
// Exit fullscreen if we're focusing a windowed plugin on a non-MacOSX
// system. We don't control event dispatch to windowed plugins on non-MacOSX,
// so we can't display the "Press ESC to leave fullscreen mode" warning on
diff --git a/embedding/components/windowwatcher/nsWindowWatcher.cpp b/embedding/components/windowwatcher/nsWindowWatcher.cpp
index 3732ea66d..fa23e285b 100644
--- a/embedding/components/windowwatcher/nsWindowWatcher.cpp
+++ b/embedding/components/windowwatcher/nsWindowWatcher.cpp
@@ -1297,6 +1297,12 @@ nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy* aParent,
}
}
+ // If a website opens a popup exit DOM fullscreen
+ if (windowIsNew && aCalledFromJS && !hasChromeParent && !isCallerChrome &&
+ parentWindow) {
+ nsIDocument::AsyncExitFullscreen(parentWindow->GetDoc());
+ }
+
if (aForceNoOpener && windowIsNew) {
NS_RELEASE(*aResult);
}
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 9337f6150..aa0ba8e3d 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -1497,14 +1497,6 @@ OptimizeMIR(MIRGenerator* mir)
if (mir->shouldCancel("Start"))
return false;
- if (!mir->compilingWasm()) {
- if (!MakeMRegExpHoistable(mir, graph))
- return false;
-
- if (mir->shouldCancel("Make MRegExp Hoistable"))
- return false;
- }
-
gs.spewPass("BuildSSA");
AssertBasicGraphCoherency(graph);
diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index 3c0f2c4b3..1e3cb0ad4 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -1975,274 +1975,6 @@ jit::ApplyTypeInformation(MIRGenerator* mir, MIRGraph& graph)
return true;
}
-// Check if `def` is only the N-th operand of `useDef`.
-static inline size_t
-IsExclusiveNthOperand(MDefinition* useDef, size_t n, MDefinition* def)
-{
- uint32_t num = useDef->numOperands();
- if (n >= num || useDef->getOperand(n) != def)
- return false;
-
- for (uint32_t i = 0; i < num; i++) {
- if (i == n)
- continue;
- if (useDef->getOperand(i) == def)
- return false;
- }
-
- return true;
-}
-
-static size_t
-IsExclusiveThisArg(MCall* call, MDefinition* def)
-{
- return IsExclusiveNthOperand(call, MCall::IndexOfThis(), def);
-}
-
-static size_t
-IsExclusiveFirstArg(MCall* call, MDefinition* def)
-{
- return IsExclusiveNthOperand(call, MCall::IndexOfArgument(0), def);
-}
-
-static bool
-IsRegExpHoistableCall(MCall* call, MDefinition* def)
-{
- if (call->isConstructing())
- return false;
-
- JSAtom* name;
- if (WrappedFunction* fun = call->getSingleTarget()) {
- if (!fun->isSelfHostedBuiltin())
- return false;
- name = GetSelfHostedFunctionName(fun->rawJSFunction());
- } else {
- MDefinition* funDef = call->getFunction();
- if (funDef->isDebugCheckSelfHosted())
- funDef = funDef->toDebugCheckSelfHosted()->input();
- if (funDef->isTypeBarrier())
- funDef = funDef->toTypeBarrier()->input();
-
- if (!funDef->isCallGetIntrinsicValue())
- return false;
- name = funDef->toCallGetIntrinsicValue()->name();
- }
-
- // Hoistable only if the RegExp is the first argument of RegExpBuiltinExec.
- CompileRuntime* runtime = GetJitContext()->runtime;
- if (name == runtime->names().RegExpBuiltinExec ||
- name == runtime->names().UnwrapAndCallRegExpBuiltinExec ||
- name == runtime->names().RegExpMatcher ||
- name == runtime->names().RegExpTester ||
- name == runtime->names().RegExpSearcher)
- {
- return IsExclusiveFirstArg(call, def);
- }
-
- if (name == runtime->names().RegExp_prototype_Exec)
- return IsExclusiveThisArg(call, def);
-
- return false;
-}
-
-static bool
-CanCompareRegExp(MCompare* compare, MDefinition* def)
-{
- MDefinition* value;
- if (compare->lhs() == def) {
- value = compare->rhs();
- } else {
- MOZ_ASSERT(compare->rhs() == def);
- value = compare->lhs();
- }
-
- // Comparing two regexp that weren't cloned will give different result
- // than if they were cloned.
- if (value->mightBeType(MIRType::Object))
- return false;
-
- // Make sure @@toPrimitive is not called which could notice
- // the difference between a not cloned/cloned regexp.
-
- JSOp op = compare->jsop();
- // Strict equality comparison won't invoke @@toPrimitive.
- if (op == JSOP_STRICTEQ || op == JSOP_STRICTNE)
- return true;
-
- if (op != JSOP_EQ && op != JSOP_NE) {
- // Relational comparison always invoke @@toPrimitive.
- MOZ_ASSERT(op == JSOP_GT || op == JSOP_GE || op == JSOP_LT || op == JSOP_LE);
- return false;
- }
-
- // Loose equality comparison can invoke @@toPrimitive.
- if (value->mightBeType(MIRType::Boolean) || value->mightBeType(MIRType::String) ||
- value->mightBeType(MIRType::Int32) ||
- value->mightBeType(MIRType::Double) || value->mightBeType(MIRType::Float32) ||
- value->mightBeType(MIRType::Symbol))
- {
- return false;
- }
-
- return true;
-}
-
-static inline void
-SetNotInWorklist(MDefinitionVector& worklist)
-{
- for (size_t i = 0; i < worklist.length(); i++)
- worklist[i]->setNotInWorklist();
-}
-
-static bool
-IsRegExpHoistable(MIRGenerator* mir, MDefinition* regexp, MDefinitionVector& worklist,
- bool* hoistable)
-{
- MOZ_ASSERT(worklist.length() == 0);
-
- if (!worklist.append(regexp))
- return false;
- regexp->setInWorklist();
-
- for (size_t i = 0; i < worklist.length(); i++) {
- MDefinition* def = worklist[i];
- if (mir->shouldCancel("IsRegExpHoistable outer loop"))
- return false;
-
- for (MUseIterator use = def->usesBegin(); use != def->usesEnd(); use++) {
- if (mir->shouldCancel("IsRegExpHoistable inner loop"))
- return false;
-
- // Ignore resume points. At this point all uses are listed.
- // No DCE or GVN or something has happened.
- if (use->consumer()->isResumePoint())
- continue;
-
- MDefinition* useDef = use->consumer()->toDefinition();
-
- // Step through a few white-listed ops.
- if (useDef->isPhi() || useDef->isFilterTypeSet() || useDef->isGuardShape()) {
- if (useDef->isInWorklist())
- continue;
-
- if (!worklist.append(useDef))
- return false;
- useDef->setInWorklist();
- continue;
- }
-
- // Instructions that doesn't invoke unknown code that may modify
- // RegExp instance or pass it to elsewhere.
- if (useDef->isRegExpMatcher() || useDef->isRegExpTester() ||
- useDef->isRegExpSearcher())
- {
- if (IsExclusiveNthOperand(useDef, 0, def))
- continue;
- } else if (useDef->isLoadFixedSlot() || useDef->isTypeOf()) {
- continue;
- } else if (useDef->isCompare()) {
- if (CanCompareRegExp(useDef->toCompare(), def))
- continue;
- }
- // Instructions that modifies `lastIndex` property.
- else if (useDef->isStoreFixedSlot()) {
- if (IsExclusiveNthOperand(useDef, 0, def)) {
- MStoreFixedSlot* store = useDef->toStoreFixedSlot();
- if (store->slot() == RegExpObject::lastIndexSlot())
- continue;
- }
- } else if (useDef->isSetPropertyCache()) {
- if (IsExclusiveNthOperand(useDef, 0, def)) {
- MSetPropertyCache* setProp = useDef->toSetPropertyCache();
- if (setProp->idval()->isConstant()) {
- Value propIdVal = setProp->idval()->toConstant()->toJSValue();
- if (propIdVal.isString()) {
- CompileRuntime* runtime = GetJitContext()->runtime;
- if (propIdVal.toString() == runtime->names().lastIndex)
- continue;
- }
- }
- }
- }
- // MCall is safe only for some known safe functions.
- else if (useDef->isCall()) {
- if (IsRegExpHoistableCall(useDef->toCall(), def))
- continue;
- }
-
- // Everything else is unsafe.
- SetNotInWorklist(worklist);
- worklist.clear();
- *hoistable = false;
-
- return true;
- }
- }
-
- SetNotInWorklist(worklist);
- worklist.clear();
- *hoistable = true;
- return true;
-}
-
-bool
-jit::MakeMRegExpHoistable(MIRGenerator* mir, MIRGraph& graph)
-{
- // If we are compiling try blocks, regular expressions may be observable
- // from catch blocks (which Ion does not compile). For now just disable the
- // pass in this case.
- if (graph.hasTryBlock())
- return true;
-
- MDefinitionVector worklist(graph.alloc());
-
- for (ReversePostorderIterator block(graph.rpoBegin()); block != graph.rpoEnd(); block++) {
- if (mir->shouldCancel("MakeMRegExpHoistable outer loop"))
- return false;
-
- for (MDefinitionIterator iter(*block); iter; iter++) {
- if (!*iter)
- MOZ_CRASH("confirm bug 1263794.");
-
- if (mir->shouldCancel("MakeMRegExpHoistable inner loop"))
- return false;
-
- if (!iter->isRegExp())
- continue;
-
- MRegExp* regexp = iter->toRegExp();
-
- bool hoistable = false;
- if (!IsRegExpHoistable(mir, regexp, worklist, &hoistable))
- return false;
-
- if (!hoistable)
- continue;
-
- // Make MRegExp hoistable
- regexp->setMovable();
- regexp->setDoNotClone();
-
- // That would be incorrect for global/sticky, because lastIndex
- // could be wrong. Therefore setting the lastIndex to 0. That is
- // faster than a not movable regexp.
- RegExpObject* source = regexp->source();
- if (source->sticky() || source->global()) {
- if (!graph.alloc().ensureBallast())
- return false;
- MConstant* zero = MConstant::New(graph.alloc(), Int32Value(0));
- regexp->block()->insertAfter(regexp, zero);
-
- MStoreFixedSlot* lastIndex =
- MStoreFixedSlot::New(graph.alloc(), regexp, RegExpObject::lastIndexSlot(), zero);
- regexp->block()->insertAfter(zero, lastIndex);
- }
- }
- }
-
- return true;
-}
-
void
jit::RenumberBlocks(MIRGraph& graph)
{
diff --git a/js/src/jit/IonAnalysis.h b/js/src/jit/IonAnalysis.h
index 49bc0b591..673c797bd 100644
--- a/js/src/jit/IonAnalysis.h
+++ b/js/src/jit/IonAnalysis.h
@@ -56,9 +56,6 @@ EliminateDeadCode(MIRGenerator* mir, MIRGraph& graph);
MOZ_MUST_USE bool
ApplyTypeInformation(MIRGenerator* mir, MIRGraph& graph);
-MOZ_MUST_USE bool
-MakeMRegExpHoistable(MIRGenerator* mir, MIRGraph& graph);
-
void
RenumberBlocks(MIRGraph& graph);
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 19266bae8..f9b0b2157 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2297,14 +2297,9 @@ LIRGenerator::visitToObjectOrNull(MToObjectOrNull* ins)
void
LIRGenerator::visitRegExp(MRegExp* ins)
{
- if (ins->mustClone()) {
- LRegExp* lir = new(alloc()) LRegExp();
- defineReturn(lir, ins);
- assignSafepoint(lir, ins);
- } else {
- RegExpObject* source = ins->source();
- define(new(alloc()) LPointer(source), ins);
- }
+ LRegExp* lir = new(alloc()) LRegExp();
+ defineReturn(lir, ins);
+ assignSafepoint(lir, ins);
}
void
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index af0abc695..81662a9be 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -8102,11 +8102,9 @@ class MDefFun
class MRegExp : public MNullaryInstruction
{
CompilerGCPointer<RegExpObject*> source_;
- bool mustClone_;
MRegExp(CompilerConstraintList* constraints, RegExpObject* source)
- : source_(source),
- mustClone_(true)
+ : source_(source)
{
setResultType(MIRType::Object);
setResultTypeSet(MakeSingletonTypeSet(constraints, source));
@@ -8116,12 +8114,6 @@ class MRegExp : public MNullaryInstruction
INSTRUCTION_HEADER(RegExp)
TRIVIAL_NEW_WRAPPERS
- void setDoNotClone() {
- mustClone_ = false;
- }
- bool mustClone() const {
- return mustClone_;
- }
RegExpObject* source() const {
return source_;
}
diff --git a/js/src/vm/CommonPropertyNames.h b/js/src/vm/CommonPropertyNames.h
index 6a8afb56b..420ee7535 100644
--- a/js/src/vm/CommonPropertyNames.h
+++ b/js/src/vm/CommonPropertyNames.h
@@ -281,13 +281,8 @@
macro(proxy, proxy, "proxy") \
macro(raw, raw, "raw") \
macro(reason, reason, "reason") \
- macro(RegExpBuiltinExec, RegExpBuiltinExec, "RegExpBuiltinExec") \
macro(RegExpFlagsGetter, RegExpFlagsGetter, "RegExpFlagsGetter") \
- macro(RegExpMatcher, RegExpMatcher, "RegExpMatcher") \
- macro(RegExpSearcher, RegExpSearcher, "RegExpSearcher") \
macro(RegExpStringIterator, RegExpStringIterator, "RegExp String Iterator") \
- macro(RegExpTester, RegExpTester, "RegExpTester") \
- macro(RegExp_prototype_Exec, RegExp_prototype_Exec, "RegExp_prototype_Exec") \
macro(Reify, Reify, "Reify") \
macro(reject, reject, "reject") \
macro(rejected, rejected, "rejected") \
@@ -360,7 +355,6 @@
macro(uninitialized, uninitialized, "uninitialized") \
macro(unsized, unsized, "unsized") \
macro(unwatch, unwatch, "unwatch") \
- macro(UnwrapAndCallRegExpBuiltinExec, UnwrapAndCallRegExpBuiltinExec, "UnwrapAndCallRegExpBuiltinExec") \
macro(url, url, "url") \
macro(usage, usage, "usage") \
macro(useAsm, useAsm, "use asm") \
diff --git a/netwerk/sctp/src/netinet/sctp.h b/netwerk/sctp/src/netinet/sctp.h
index a5ff4eb0b..962ce1140 100755
--- a/netwerk/sctp/src/netinet/sctp.h
+++ b/netwerk/sctp/src/netinet/sctp.h
@@ -32,7 +32,7 @@
#ifdef __FreeBSD__
#include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp.h 279859 2015-03-10 19:49:25Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp.h 356270 2020-01-02 13:55:10Z tuexen $");
#endif
#ifndef _NETINET_SCTP_H_
@@ -598,7 +598,10 @@ struct sctp_error_no_user_data {
#define SCTP_MOBILITY_PRIM_DELETED 0x00000004
-#define SCTP_SMALLEST_PMTU 512 /* smallest pmtu allowed when disabling PMTU discovery */
+/* Smallest PMTU allowed when disabling PMTU discovery */
+#define SCTP_SMALLEST_PMTU 512
+/* Largest PMTU allowed when disabling PMTU discovery */
+#define SCTP_LARGEST_PMTU 65536
#if defined(__Userspace_os_Windows)
#pragma pack()
diff --git a/netwerk/sctp/src/netinet/sctp_auth.c b/netwerk/sctp/src/netinet/sctp_auth.c
index ee5ca36ce..4e9f7e4cd 100755
--- a/netwerk/sctp/src/netinet/sctp_auth.c
+++ b/netwerk/sctp/src/netinet/sctp_auth.c
@@ -32,7 +32,7 @@
#ifdef __FreeBSD__
#include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 271673 2014-09-16 14:20:33Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 355931 2019-12-20 15:25:08Z tuexen $");
#endif
#include <netinet/sctp_os.h>
@@ -1450,7 +1450,8 @@ sctp_auth_get_cookie_params(struct sctp_tcb *stcb, struct mbuf *m,
ptype = ntohs(phdr->param_type);
plen = ntohs(phdr->param_length);
- if ((plen == 0) || (offset + plen > length))
+ if ((plen < sizeof(struct sctp_paramhdr)) ||
+ (offset + plen > length))
break;
if (ptype == SCTP_RANDOM) {
diff --git a/netwerk/sctp/src/netinet/sctp_pcb.c b/netwerk/sctp/src/netinet/sctp_pcb.c
index 58c164f50..ea5725c85 100755
--- a/netwerk/sctp/src/netinet/sctp_pcb.c
+++ b/netwerk/sctp/src/netinet/sctp_pcb.c
@@ -32,7 +32,7 @@
#ifdef __FreeBSD__
#include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 280459 2015-03-24 21:12:45Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 355931 2019-12-20 15:25:08Z tuexen $");
#endif
#include <netinet/sctp_os.h>
@@ -7213,7 +7213,7 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
if (offset + plen > limit) {
break;
}
- if (plen == 0) {
+ if (plen < sizeof(struct sctp_paramhdr)) {
break;
}
#ifdef INET
@@ -7413,6 +7413,9 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
if (plen > sizeof(lstore)) {
return (-23);
}
+ if (plen < sizeof(struct sctp_asconf_addrv4_param)) {
+ return (-101);
+ }
phdr = sctp_get_next_param(m, offset,
(struct sctp_paramhdr *)&lstore,
min(plen,sizeof(lstore)));
diff --git a/netwerk/sctp/src/netinet/sctp_usrreq.c b/netwerk/sctp/src/netinet/sctp_usrreq.c
index d24a21815..7ffd8e8c8 100755
--- a/netwerk/sctp/src/netinet/sctp_usrreq.c
+++ b/netwerk/sctp/src/netinet/sctp_usrreq.c
@@ -32,7 +32,7 @@
#ifdef __FreeBSD__
#include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_usrreq.c 280459 2015-03-24 21:12:45Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_usrreq.c 356270 2020-01-02 13:55:10Z tuexen $");
#endif
#include <netinet/sctp_os.h>
@@ -5995,6 +5995,14 @@ sctp_setopt(struct socket *so, int optname, void *optval, size_t optsize,
SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL);
return (EINVAL);
}
+ if ((paddrp->spp_flags & SPP_PMTUD_DISABLE) &&
+ ((paddrp->spp_pathmtu < SCTP_SMALLEST_PMTU) ||
+ (paddrp->spp_pathmtu > SCTP_LARGEST_PMTU))) {
+ if (stcb)
+ SCTP_TCB_UNLOCK(stcb);
+ SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL);
+ return (EINVAL);
+ }
if (stcb != NULL) {
/************************TCB SPECIFIC SET ******************/
@@ -6038,7 +6046,7 @@ sctp_setopt(struct socket *so, int optname, void *optval, size_t optsize,
sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SOCKOPT, SCTP_SO_LOCKED);
sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
}
- if ((paddrp->spp_flags & SPP_PMTUD_DISABLE) && (paddrp->spp_pathmtu >= SCTP_SMALLEST_PMTU)) {
+ if (paddrp->spp_flags & SPP_PMTUD_DISABLE) {
if (SCTP_OS_TIMER_PENDING(&net->pmtu_timer.timer)) {
sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
SCTP_FROM_SCTP_USRREQ+SCTP_LOC_10);
@@ -6160,7 +6168,7 @@ sctp_setopt(struct socket *so, int optname, void *optval, size_t optsize,
}
sctp_stcb_feature_on(inp, stcb, SCTP_PCB_FLAGS_DONOT_HEARTBEAT);
}
- if ((paddrp->spp_flags & SPP_PMTUD_DISABLE) && (paddrp->spp_pathmtu >= SCTP_SMALLEST_PMTU)) {
+ if (paddrp->spp_flags & SPP_PMTUD_DISABLE) {
TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
if (SCTP_OS_TIMER_PENDING(&net->pmtu_timer.timer)) {
sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-16 14:45:46 +0000