abc/lwip
1
0
Fork 0
mirror of https://git.savannah.nongnu.org/git/lwip.git synced 2026-08-10 01:23:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

tcp: Fix ooseq processing when seqno is near 2^32

Browse Source 
An edge case in out-of-sequence TCP packet processing did not use the
appropriate macro to check if the sender overran the recieve window.

Consequently, this case sometimes evaluated to true when it shouldn't, which
resulted in various bad behavior, including trying to resize a TCP buffer to 4
gigabytes.
This commit is contained in:
Clint Sbisa
2015-02-11 12:18:08 -08:00
committed by goldsimon
parent 94f7bcef67
commit 32f6e7e231
2 changed files with 95 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/core/tcp_in.c
View File

@@ -1581,7 +1581,7 @@ tcp_receive(struct tcp_pcb *pcb)
pbuf_realloc(next->p, next->len);
}
/* check if the remote side overruns our receive window */
if ((u32_t)tcplen + seqno > pcb->rcv_nxt + (u32_t)pcb->rcv_wnd) {
if (TCP_SEQ_GT((u32_t)tcplen + seqno, pcb->rcv_nxt + (u32_t)pcb->rcv_wnd)) {
LWIP_DEBUGF(TCP_INPUT_DEBUG,
("tcp_receive: other end overran receive window"
"seqno %"U32_F" len %"U16_F" right edge %"U32_F"\n",