MFC r352550:

Fix the handling of invalid parameters in ASCONF chunks.
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.


git-svn-id: https://svn.freebsd.org/base/stable/12@352674 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f

sys/netinet/sctp_asconf.c

@@ -703,6 +703,7 @@ sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 		if (param_length <= sizeof(struct sctp_paramhdr)) {
 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 			sctp_m_freem(m_ack);
+			return;
 		}
 		/* get the entire parameter */
 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);