From 610a2e9ca5683c785420b54a49438bee15e48acc Mon Sep 17 00:00:00 2001 From: Bill Fenner Date: Tue, 7 Oct 1997 21:10:06 +0000 Subject: [PATCH] Don't allow the window to be increased beyond what is possible to represent in the TCP header. The old code did effectively: win = min(win, MAX_ALLOWED); win = max(win, what_i_think_i_advertised_last_time); so if what_i_think_i_advertised_last_time is bigger than can be represented in the header (e.g. large buffers and no window scaling) then we stuff a too-big number into a short. This fix reverses the order of the comparisons. PR: kern/4712 --- sys/netinet/tcp_output.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c index 5773d9a0697f..c5299c61bb85 100644 --- a/sys/netinet/tcp_output.c +++ b/sys/netinet/tcp_output.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)tcp_output.c 8.4 (Berkeley) 5/24/95 - * $Id: tcp_output.c,v 1.25 1997/08/02 14:32:56 bde Exp $ + * $Id: tcp_output.c,v 1.26 1997/09/16 18:36:05 joerg Exp $ */ #include "opt_tcpdebug.h" @@ -569,10 +569,10 @@ send: */ if (win < (long)(so->so_rcv.sb_hiwat / 4) && win < (long)tp->t_maxseg) win = 0; - if (win > (long)TCP_MAXWIN << tp->rcv_scale) - win = (long)TCP_MAXWIN << tp->rcv_scale; if (win < (long)(tp->rcv_adv - tp->rcv_nxt)) win = (long)(tp->rcv_adv - tp->rcv_nxt); + if (win > (long)TCP_MAXWIN << tp->rcv_scale) + win = (long)TCP_MAXWIN << tp->rcv_scale; ti->ti_win = htons((u_short) (win>>tp->rcv_scale)); if (SEQ_GT(tp->snd_up, tp->snd_nxt)) { ti->ti_urp = htons((u_short)(tp->snd_up - tp->snd_nxt));