From edfe3302571611f67744650481992009652b8406 Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <dborkman@redhat.com>
Date: Thu, 7 Feb 2013 01:41:39 +0000
Subject: [PATCH] --- yaml --- r: 352131 b: refs/heads/master c:
 241448c2b84ff02a46ce88199e05fdeb55bad449 h: refs/heads/master i:   352129:
 1752c69f519d54440f3ce376a0e0f3660080af0b   352127:
 303694cf228a8dfc28fc9081e72180bb16372f4a v: v3

---
 [refs]                |  2 +-
 trunk/net/sctp/auth.c | 21 ++++++++++++---------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/[refs] b/[refs]
index b1e0a372aee1..710de6a4afc6 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 85bd1798b24a13462d7b064961e7a9da3bb12db1
+refs/heads/master: 241448c2b84ff02a46ce88199e05fdeb55bad449
diff --git a/trunk/net/sctp/auth.c b/trunk/net/sctp/auth.c
index 159b9bc5d633..94a12de58691 100644
--- a/trunk/net/sctp/auth.c
+++ b/trunk/net/sctp/auth.c
@@ -200,10 +200,14 @@ static struct sctp_auth_bytes *sctp_auth_make_key_vector(
 	struct sctp_auth_bytes *new;
 	__u32	len;
 	__u32	offset = 0;
+	__u16	random_len, hmacs_len, chunks_len = 0;
 
-	len = ntohs(random->param_hdr.length) + ntohs(hmacs->param_hdr.length);
-        if (chunks)
-		len += ntohs(chunks->param_hdr.length);
+	random_len = ntohs(random->param_hdr.length);
+	hmacs_len = ntohs(hmacs->param_hdr.length);
+	if (chunks)
+		chunks_len = ntohs(chunks->param_hdr.length);
+
+	len = random_len + hmacs_len + chunks_len;
 
 	new = kmalloc(sizeof(struct sctp_auth_bytes) + len, gfp);
 	if (!new)
@@ -211,16 +215,15 @@ static struct sctp_auth_bytes *sctp_auth_make_key_vector(
 
 	new->len = len;
 
-	memcpy(new->data, random, ntohs(random->param_hdr.length));
-	offset += ntohs(random->param_hdr.length);
+	memcpy(new->data, random, random_len);
+	offset += random_len;
 
 	if (chunks) {
-		memcpy(new->data + offset, chunks,
-			ntohs(chunks->param_hdr.length));
-		offset += ntohs(chunks->param_hdr.length);
+		memcpy(new->data + offset, chunks, chunks_len);
+		offset += chunks_len;
 	}
 
-	memcpy(new->data + offset, hmacs, ntohs(hmacs->param_hdr.length));
+	memcpy(new->data + offset, hmacs, hmacs_len);
 
 	return new;
 }