diff options
| author | fenner <fenner@FreeBSD.org> | 1997-10-07 21:10:06 +0000 |
|---|---|---|
| committer | fenner <fenner@FreeBSD.org> | 1997-10-07 21:10:06 +0000 |
| commit | aa0e9691a0bfe95ed60368820d85c1c76a293784 (patch) | |
| tree | 32d463b76c38f236019d6ccb7d2b92298de0de8d /sys/netinet/tcp_output.c | |
| parent | 5e2703d7ee0879847269df432ef3737ec99b2bd8 (diff) | |
| download | FreeBSD-src-aa0e9691a0bfe95ed60368820d85c1c76a293784.zip FreeBSD-src-aa0e9691a0bfe95ed60368820d85c1c76a293784.tar.gz | |
Don't allow the window to be increased beyond what is possible to
represent in the TCP header. The old code did effectively:
win = min(win, MAX_ALLOWED);
win = max(win, what_i_think_i_advertised_last_time);
so if what_i_think_i_advertised_last_time is bigger than can be
represented in the header (e.g. large buffers and no window scaling)
then we stuff a too-big number into a short. This fix reverses the
order of the comparisons.
PR: kern/4712
Diffstat (limited to 'sys/netinet/tcp_output.c')
| -rw-r--r-- | sys/netinet/tcp_output.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c index 5773d9a..c5299c6 100644 --- a/sys/netinet/tcp_output.c +++ b/sys/netinet/tcp_output.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)tcp_output.c 8.4 (Berkeley) 5/24/95 - * $Id: tcp_output.c,v 1.25 1997/08/02 14:32:56 bde Exp $ + * $Id: tcp_output.c,v 1.26 1997/09/16 18:36:05 joerg Exp $ */ #include "opt_tcpdebug.h" @@ -569,10 +569,10 @@ send: */ if (win < (long)(so->so_rcv.sb_hiwat / 4) && win < (long)tp->t_maxseg) win = 0; - if (win > (long)TCP_MAXWIN << tp->rcv_scale) - win = (long)TCP_MAXWIN << tp->rcv_scale; if (win < (long)(tp->rcv_adv - tp->rcv_nxt)) win = (long)(tp->rcv_adv - tp->rcv_nxt); + if (win > (long)TCP_MAXWIN << tp->rcv_scale) + win = (long)TCP_MAXWIN << tp->rcv_scale; ti->ti_win = htons((u_short) (win>>tp->rcv_scale)); if (SEQ_GT(tp->snd_up, tp->snd_nxt)) { ti->ti_urp = htons((u_short)(tp->snd_up - tp->snd_nxt)); |
