mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2025-01-01 12:00:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added check to prevent tcp_pcb->snd_queuelen from overflowing.

Browse Source
This commit is contained in:
goldsimon 2007-06-29 17:09:47 +00:00
parent af71292aba
commit 6c3c184bc7
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG
View File

@ -238,6 +238,9 @@ HISTORY
++ Bug fixes: ++ Bug fixes:
2007-06-28 Simon Goldschmidt
* tcp_out.c: Added check to prevent tcp_pcb->snd_queuelen from overflowing.
2007-06-28 Simon Goldschmidt 2007-06-28 Simon Goldschmidt
* tcp.h: Fixed bug #20287: Fixed nagle algorithm (sending was done too early if * tcp.h: Fixed bug #20287: Fixed nagle algorithm (sending was done too early if
a segment contained chained pbufs) a segment contained chained pbufs)

6
src/core/tcp_out.c
View File

@ -158,7 +158,8 @@ tcp_enqueue(struct tcp_pcb *pcb, void *arg, u16_t len,
/* If total number of pbufs on the unsent/unacked queues exceeds the /* If total number of pbufs on the unsent/unacked queues exceeds the
* configured maximum, return an error */ * configured maximum, return an error */
queuelen = pcb->snd_queuelen; queuelen = pcb->snd_queuelen;
if (queuelen >= TCP_SND_QUEUELEN) { /* check for configured max queuelen and possible overflow of u8_t */
if ((queuelen >= TCP_SND_QUEUELEN) || (queuelen > 253)) {
LWIP_DEBUGF(TCP_OUTPUT_DEBUG | 3, ("tcp_enqueue: too long queue %"U16_F" (max %"U16_F")\n", queuelen, TCP_SND_QUEUELEN)); LWIP_DEBUGF(TCP_OUTPUT_DEBUG | 3, ("tcp_enqueue: too long queue %"U16_F" (max %"U16_F")\n", queuelen, TCP_SND_QUEUELEN));
TCP_STATS_INC(tcp.memerr); TCP_STATS_INC(tcp.memerr);
return ERR_MEM; return ERR_MEM;
@ -261,7 +262,8 @@ tcp_enqueue(struct tcp_pcb *pcb, void *arg, u16_t len,
/* Now that there are more segments queued, we check again if the /* Now that there are more segments queued, we check again if the
length of the queue exceeds the configured maximum. */ length of the queue exceeds the configured maximum. */
if (queuelen > TCP_SND_QUEUELEN) { /* check for configured max queuelen and possible overflow of u8_t */
if ((queuelen > TCP_SND_QUEUELEN) || (queuelen > 253)) {
LWIP_DEBUGF(TCP_OUTPUT_DEBUG | 2, ("tcp_enqueue: queue too long %"U16_F" (%"U16_F")\n", queuelen, TCP_SND_QUEUELEN)); LWIP_DEBUGF(TCP_OUTPUT_DEBUG | 2, ("tcp_enqueue: queue too long %"U16_F" (%"U16_F")\n", queuelen, TCP_SND_QUEUELEN));
goto memerr; goto memerr;
} }