mirror of
https://git.savannah.nongnu.org/git/lwip.git
synced 2026-05-22 16:16:55 +08:00
Fixed bug #29080: Correctly handle remote side overrunning our rcv_wnd in ooseq case.
This commit is contained in:
@@ -1402,6 +1402,24 @@ tcp_receive(struct tcp_pcb *pcb)
|
||||
next->len = (u16_t)(seqno - next->tcphdr->seqno);
|
||||
pbuf_realloc(next->p, next->len);
|
||||
}
|
||||
/* check if the remote side overruns our receive window */
|
||||
if ((u32_t)tcplen + seqno > pcb->rcv_nxt + (u32_t)pcb->rcv_wnd) {
|
||||
LWIP_DEBUGF(TCP_INPUT_DEBUG,
|
||||
("tcp_receive: other end overran receive window"
|
||||
"seqno %"U32_F" len %"U16_F" right edge %"U32_F"\n",
|
||||
seqno, tcplen, pcb->rcv_nxt + pcb->rcv_wnd));
|
||||
if (TCPH_FLAGS(next->next->tcphdr) & TCP_FIN) {
|
||||
/* Must remove the FIN from the header as we're trimming
|
||||
* that byte of sequence-space from the packet */
|
||||
TCPH_FLAGS_SET(next->next->tcphdr, TCPH_FLAGS(next->next->tcphdr) &~ TCP_FIN);
|
||||
}
|
||||
/* Adjust length of segment to fit in the window. */
|
||||
next->next->len = pcb->rcv_nxt + pcb->rcv_wnd - seqno;
|
||||
pbuf_realloc(next->next->p, next->next->len);
|
||||
tcplen = TCP_TCPLEN(next->next);
|
||||
LWIP_ASSERT("tcp_receive: segment not trimmed correctly to rcv_wnd\n",
|
||||
(seqno + tcplen) == (pcb->rcv_nxt + pcb->rcv_wnd));
|
||||
}
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user