diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 2a11b464182ed242db1b28966615079e207852c9..e6ac0bc410a7747c46ccd7d68f31a962867e36b9 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -1955,6 +1955,10 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc, err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); if (err) goto err; + if (unlikely(sinfo->sinfo_stream >= asoc->stream.outcnt)) { + err = -EINVAL; + goto err; + } } if (sctp_state(asoc, CLOSED)) {