Skip to content

sctp: fix outgoing SACK corruption on DATA chunk reception - #271

Open
r-c-n wants to merge 1 commit into
sepfy:mainfrom
r-c-n:fix-sctp-sack
Open

sctp: fix outgoing SACK corruption on DATA chunk reception#271
r-c-n wants to merge 1 commit into
sepfy:mainfrom
r-c-n:fix-sctp-sack

Conversation

@r-c-n

@r-c-n r-c-n commented Aug 13, 2026

Copy link
Copy Markdown

On libpeer's own SCTP implementation, reception of a DATA chunk may result in a call to the onmessage callback, if available. Before running the callback, sctp_incoming_data() prepares a SACK chunk that is meant to be sent after the callback is done, but if the callback sends any data as a response, it'll overwrite the already formatted SACK chunk header, corrupting the SACK.

Fix it by moving the SACK send before the callback.

NOTE: similar problems may surface depending on what the onmessage, onopen and onclose do. I've only seen this happening in the SCTP_DATA case but I think it could also happen in the SCTP_COOKIE_ECHO case. I haven't tested it, though, so any opinion is appreciated.

Example

Before the fix, if the peer receives a DATA chunk, it first sends another DATA chunk as a response (similar to what

static void onmessage(char* msg, size_t len, void* userdata, uint16_t sid) {
does). Then, it sends the SACK chunk, whose buffer has been overwritten by the previous DATA send:

libpeer_sctp_malformed_sack_1 libpeer_sctp_malformed_sack_2 libpeer_sctp_malformed_sack_3

After the fix, on the same interchange, the peer sends the SACK first, then runs the onmessage callback to send the DATA chunk:

libpeer_sctp_malformed_sack_fix_1 libpeer_sctp_malformed_sack_fix_2 libpeer_sctp_malformed_sack_fix_3

On libpeer's own SCTP implementation, reception of a DATA chunk may
result in a call to the "onmessage" callback, if available. Before
running the callback, sctp_incoming_data() prepares a SACK chunk that is
meant to be sent after the callback is done, but if the callback sends
any data as a response, it'll overwrite the already formatted SACK chunk
header, corrupting the SACK.

Fix it by sending moving the SACK send before the callback.

Signed-off-by: Ricardo Cañuelo Navarro <rcn@igalia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant