sctp: check send stream number after wait_for_sndbuf

[linux-2.6-microblaze.git] / net / sctp / socket.c

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index b91616f..218e098 100644 (file)
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1830,6 +1830,10 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
                err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
                if (err)
                        goto err;
+               if (unlikely(sinfo->sinfo_stream >= asoc->stream.outcnt)) {
+                       err = -EINVAL;
+                       goto err;
+               }
        }
 
        if (sctp_state(asoc, CLOSED)) {