---

yaml
---
r: 352131
b: refs/heads/master
c: 241448c
h: refs/heads/master
i:
  352129: 1752c69
  352127: 303694c
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 85bd1798b24a13462d7b064961e7a9da3bb12db1
+refs/heads/master: 241448c2b84ff02a46ce88199e05fdeb55bad449

trunk/net/sctp/auth.c

@@ -200,27 +200,30 @@ static struct sctp_auth_bytes *sctp_auth_make_key_vector(
 	struct sctp_auth_bytes *new;
 	__u32	len;
 	__u32	offset = 0;
+	__u16	random_len, hmacs_len, chunks_len = 0;
 
-	len = ntohs(random->param_hdr.length) + ntohs(hmacs->param_hdr.length);
-        if (chunks)
-		len += ntohs(chunks->param_hdr.length);
+	random_len = ntohs(random->param_hdr.length);
+	hmacs_len = ntohs(hmacs->param_hdr.length);
+	if (chunks)
+		chunks_len = ntohs(chunks->param_hdr.length);
+
+	len = random_len + hmacs_len + chunks_len;
 
 	new = kmalloc(sizeof(struct sctp_auth_bytes) + len, gfp);
 	if (!new)
 		return NULL;
 
 	new->len = len;
 
-	memcpy(new->data, random, ntohs(random->param_hdr.length));
-	offset += ntohs(random->param_hdr.length);
+	memcpy(new->data, random, random_len);
+	offset += random_len;
 
 	if (chunks) {
-		memcpy(new->data + offset, chunks,
-			ntohs(chunks->param_hdr.length));
-		offset += ntohs(chunks->param_hdr.length);
+		memcpy(new->data + offset, chunks, chunks_len);
+		offset += chunks_len;
 	}
 
-	memcpy(new->data + offset, hmacs, ntohs(hmacs->param_hdr.length));
+	memcpy(new->data + offset, hmacs, hmacs_len);
 
 	return new;
 }