X-Authentication-Warning:	delorie.com: mail set sender to djgpp-bounces using -f
X-Recipient:	djgpp AT delorie DOT com
X-Original-DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=gmail.com; s=20120113;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:cc:content-type;
	bh=vS7BsTLcwhbgIDFJ7ppPPeAOj5jPA30Xil1SIo7KF9U=;
	b=xUhBFVwXuN/GB0J0XGIFYdYlakEaoZgeZ/7sYzsEXVapvCnBvnAa2P7Fd4bbsMqCgx
	B7wbFvnMziA3R+iu2LDmzsTeQ2s0XxQusmS99LO4MYJW3DeNtgoG6CaMOeOJ1OhM4JLk
	Au16bj1+PFyRrgfa17Han8LonwhhJHSSBC2LML735l7XSkcXtrkAGji7crl+IQ7bN9r+
	enqOzyyVwEzdbhfMEzuDB+1VHVWz5h02A1EthnB5RN3kMFKY+pLFhSq3J0WHbJCc6jSH
	WYiBiNdLspKNX0wPCZ/hhwQPEsbcpE/xBJHcTLps4J8JanQfm2if8ecqGaI1CRc9zk1s
	yxHQ==
MIME-Version:	1.0
X-Received:	by 10.107.157.4 with SMTP id g4mr3505867ioe.66.1436950204640; Wed,
	15 Jul 2015 01:50:04 -0700 (PDT)
In-Reply-To:	<53bcd9ee-c834-4157-a904-49c75f4403e2@googlegroups.com>
References:	<bd42a667-3d17-4978-b3de-b25a79d1c11f AT googlegroups DOT com>
	<53bcd9ee-c834-4157-a904-49c75f4403e2 AT googlegroups DOT com>
Date:	Wed, 15 Jul 2015 11:50:04 +0300
Message-ID:	<CAA2C=vAPPOg03iQp=Wy1Cw6wmNoeognfcos0V9NgxCHE5X9unw@mail.gmail.com>
Subject:	Re: wat3222br3.zip crashes when viewing some web page
From:	"Ozkan Sezer (sezeroz AT gmail DOT com) [via djgpp AT delorie DOT com]" <djgpp AT delorie DOT com>
To:	djgpp AT delorie DOT com
Cc:	Gisle Vanem <gvanem AT yahoo DOT no>
Reply-To:	djgpp AT delorie DOT com
Errors-To:	nobody AT delorie DOT com
X-Mailing-List:	djgpp AT delorie DOT com
X-Unsubscribes-To:	listserv AT delorie DOT com

On 7/14/15, iw2evk AT gmail DOT com [via djgpp AT delorie DOT com] <djgpp AT delorie DOT com> wrote:
>
>
> Hi all,
>
> i share with you the reply of Mikulas
>
> Hi
>
> I created Watt-32 patch for this bug.
>
> Mikulas
>
>
> --- src/tcp_fsm.c_	2005-10-20 17:04:18.000000000 +0200
> +++ src/tcp_fsm.c	2015-07-12 17:12:46.000000000 +0200
> @@ -1060,7 +1060,7 @@
>     * If it's before recv_next, we've seen it all before; if it's after
>     * then the peer (or someone else) sent more than we said we could take.
>     */
> -  if ((unsigned)len - ldiff > s->adv_win)
> +  if ((unsigned)len - ldiff > s->max_rx_data - s->rx_datalen)
>    {
>      TCP_TRACE (("tcp_ProcessData (%u): packet ends outside %lu/%lu\n",
>                  __LINE__, s->recv_next, s->recv_next + s->adv_win));
> @@ -1210,7 +1210,7 @@
>    }
>
>    left_edge  = s->recv_next - s->rx_datalen;
> -  right_edge = s->recv_next + s->adv_win;
> +  right_edge = s->recv_next + s->max_rx_data - s->rx_datalen;
>
>    /* segment is left of expected recv-window
>     */
>

Gisle Vanem:  is the patch correct?

--
O.S.

- Raw text -