X-Authentication-Warning: delorie.com: mail set sender to djgpp-bounces using -f
X-Recipient: djgpp AT delorie DOT com
X-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        bh=vS7BsTLcwhbgIDFJ7ppPPeAOj5jPA30Xil1SIo7KF9U=;
        b=xUhBFVwXuN/GB0J0XGIFYdYlakEaoZgeZ/7sYzsEXVapvCnBvnAa2P7Fd4bbsMqCgx
         B7wbFvnMziA3R+iu2LDmzsTeQ2s0XxQusmS99LO4MYJW3DeNtgoG6CaMOeOJ1OhM4JLk
         Au16bj1+PFyRrgfa17Han8LonwhhJHSSBC2LML735l7XSkcXtrkAGji7crl+IQ7bN9r+
         enqOzyyVwEzdbhfMEzuDB+1VHVWz5h02A1EthnB5RN3kMFKY+pLFhSq3J0WHbJCc6jSH
         WYiBiNdLspKNX0wPCZ/hhwQPEsbcpE/xBJHcTLps4J8JanQfm2if8ecqGaI1CRc9zk1s
         yxHQ==
MIME-Version: 1.0
X-Received: by 10.107.157.4 with SMTP id g4mr3505867ioe.66.1436950204640; Wed,
 15 Jul 2015 01:50:04 -0700 (PDT)
In-Reply-To: <53bcd9ee-c834-4157-a904-49c75f4403e2@googlegroups.com>
References: <bd42a667-3d17-4978-b3de-b25a79d1c11f AT googlegroups DOT com>
	<53bcd9ee-c834-4157-a904-49c75f4403e2 AT googlegroups DOT com>
Date: Wed, 15 Jul 2015 11:50:04 +0300
Message-ID: <CAA2C=vAPPOg03iQp=Wy1Cw6wmNoeognfcos0V9NgxCHE5X9unw@mail.gmail.com>
Subject: Re: wat3222br3.zip crashes when viewing some web page
From: "Ozkan Sezer (sezeroz AT gmail DOT com) [via djgpp AT delorie DOT com]" <djgpp AT delorie DOT com>
To: djgpp AT delorie DOT com
Cc: Gisle Vanem <gvanem AT yahoo DOT no>
Content-Type: text/plain; charset=UTF-8
Reply-To: djgpp AT delorie DOT com
Errors-To: nobody AT delorie DOT com
X-Mailing-List: djgpp AT delorie DOT com
X-Unsubscribes-To: listserv AT delorie DOT com
Precedence: bulk

On 7/14/15, iw2evk AT gmail DOT com [via djgpp AT delorie DOT com] <djgpp AT delorie DOT com> wrote:
>
>
> Hi all,
>
> i share with you the reply of Mikulas
>
> Hi
>
> I created Watt-32 patch for this bug.
>
> Mikulas
>
>
> --- src/tcp_fsm.c_	2005-10-20 17:04:18.000000000 +0200
> +++ src/tcp_fsm.c	2015-07-12 17:12:46.000000000 +0200
> @@ -1060,7 +1060,7 @@
>     * If it's before recv_next, we've seen it all before; if it's after
>     * then the peer (or someone else) sent more than we said we could take.
>     */
> -  if ((unsigned)len - ldiff > s->adv_win)
> +  if ((unsigned)len - ldiff > s->max_rx_data - s->rx_datalen)
>    {
>      TCP_TRACE (("tcp_ProcessData (%u): packet ends outside %lu/%lu\n",
>                  __LINE__, s->recv_next, s->recv_next + s->adv_win));
> @@ -1210,7 +1210,7 @@
>    }
>
>    left_edge  = s->recv_next - s->rx_datalen;
> -  right_edge = s->recv_next + s->adv_win;
> +  right_edge = s->recv_next + s->max_rx_data - s->rx_datalen;
>
>    /* segment is left of expected recv-window
>     */
>

Gisle Vanem:  is the patch correct?

--
O.S.