In the Linux kernel, the following vulnerability has been resolved:
sctp: fix a potential overflow in sctpifwdtsnskip
Currently, when traversing ifwdtsn skips with sctpwalkifwdtsn, it only checks the pos against the end of the chunk. However, the data left for the last pos may be < sizeof(struct sctpifwdtsnskip), and dereference it as struct sctpifwdtsn_skip may cause coverflow.
This patch fixes it by checking the pos against "the end of the chunk - sizeof(struct sctpifwdtsnskip)" in sctpifwdtsnskip, similar to sctpfwdtsnskip.