X-Authentication-Warning:	delorie.com: mail set sender to djgpp-bounces using -f
X-Received:	by 10.112.255.66 with SMTP id ao2mr21682905lbd.15.1436893366032;
	Tue, 14 Jul 2015 10:02:46 -0700 (PDT)
X-Received:	by 10.140.19.46 with SMTP id 43mr585881qgg.13.1436893365451; Tue,
	14 Jul 2015 10:02:45 -0700 (PDT)
Newsgroups:	comp.os.msdos.djgpp
Date:	Tue, 14 Jul 2015 10:02:45 -0700 (PDT)
In-Reply-To:	<bd42a667-3d17-4978-b3de-b25a79d1c11f@googlegroups.com>
Complaints-To:	groups-abuse AT google DOT com
Injection-Info:	glegroupsg2000goo.googlegroups.com; posting-host=93.144.0.220; posting-account=eVrEawoAAADQsAq8j1547wmK-xA1XmPE
NNTP-Posting-Host:	93.144.0.220
References:	<bd42a667-3d17-4978-b3de-b25a79d1c11f AT googlegroups DOT com>
User-Agent:	G2/1.0
MIME-Version:	1.0
Message-ID:	<53bcd9ee-c834-4157-a904-49c75f4403e2@googlegroups.com>
Subject:	Re: wat3222br3.zip crashes when viewing some web page
From:	"iw2evk AT gmail DOT com [via djgpp AT delorie DOT com]" <djgpp AT delorie DOT com>
Injection-Date:	Tue, 14 Jul 2015 17:02:45 +0000
Bytes:	2138
Lines:	32
To:	djgpp AT delorie DOT com
DJ-Gateway:	from newsgroup comp.os.msdos.djgpp
Reply-To:	djgpp AT delorie DOT com
Errors-To:	nobody AT delorie DOT com
X-Mailing-List:	djgpp AT delorie DOT com
X-Unsubscribes-To:	listserv AT delorie DOT com

Hi all,

i share with you the reply of Mikulas

Hi

I created Watt-32 patch for this bug.

Mikulas


--- src/tcp_fsm.c_	2005-10-20 17:04:18.000000000 +0200
+++ src/tcp_fsm.c	2015-07-12 17:12:46.000000000 +0200
@@ -1060,7 +1060,7 @@
    * If it's before recv_next, we've seen it all before; if it's after
    * then the peer (or someone else) sent more than we said we could take.
    */
-  if ((unsigned)len - ldiff > s->adv_win)
+  if ((unsigned)len - ldiff > s->max_rx_data - s->rx_datalen)
   {
     TCP_TRACE (("tcp_ProcessData (%u): packet ends outside %lu/%lu\n",
                 __LINE__, s->recv_next, s->recv_next + s->adv_win));
@@ -1210,7 +1210,7 @@
   }
 
   left_edge  = s->recv_next - s->rx_datalen;
-  right_edge = s->recv_next + s->adv_win;
+  right_edge = s->recv_next + s->max_rx_data - s->rx_datalen;
 
   /* segment is left of expected recv-window
    */

- Raw text -