mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2025-03-06 22:13:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed bug #22249: division by zero could occur if a remote host sent a zero mss as TCP option.

Browse Source
This commit is contained in:
goldsimon 2008-03-26 11:57:12 +00:00
parent bcb4afa886
commit aee9c4c8e6
3 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG
View File

@ -22,6 +22,10 @@ HISTORY
++ Bugfixes: ++ Bugfixes:
2008-03-26 Simon Goldschmidt
* tcp_in.c, tcp.c: fixed bug #22249: division by zero could occur if a remote
host sent a zero mss as TCP option.
(STABLE-1.3.0) (STABLE-1.3.0)

6
src/core/tcp.c
View File

@ -509,7 +509,8 @@ tcp_connect(struct tcp_pcb *pcb, struct ip_addr *ipaddr, u16_t port,
pcb->rcv_wnd = TCP_WND; pcb->rcv_wnd = TCP_WND;
pcb->rcv_ann_wnd = TCP_WND; pcb->rcv_ann_wnd = TCP_WND;
pcb->snd_wnd = TCP_WND; pcb->snd_wnd = TCP_WND;
/* The send MSS is updated when an MSS option is received. */ /* As initial send MSS, we use TCP_MSS but limit it to 536.
The send MSS is updated when an MSS option is received. */
pcb->mss = (TCP_MSS > 536) ? 536 : TCP_MSS; pcb->mss = (TCP_MSS > 536) ? 536 : TCP_MSS;
#if TCP_CALCULATE_EFF_SEND_MSS #if TCP_CALCULATE_EFF_SEND_MSS
pcb->mss = tcp_eff_send_mss(pcb->mss, ipaddr); pcb->mss = tcp_eff_send_mss(pcb->mss, ipaddr);
@ -991,7 +992,8 @@ tcp_alloc(u8_t prio)
pcb->rcv_ann_wnd = TCP_WND; pcb->rcv_ann_wnd = TCP_WND;
pcb->tos = 0; pcb->tos = 0;
pcb->ttl = TCP_TTL; pcb->ttl = TCP_TTL;
/* The send MSS is updated when an MSS option is received. */ /* As initial send MSS, we use TCP_MSS but limit it to 536.
The send MSS is updated when an MSS option is received. */
pcb->mss = (TCP_MSS > 536) ? 536 : TCP_MSS; pcb->mss = (TCP_MSS > 536) ? 536 : TCP_MSS;
pcb->rto = 3000 / TCP_SLOW_INTERVAL; pcb->rto = 3000 / TCP_SLOW_INTERVAL;
pcb->sa = 0; pcb->sa = 0;

3
src/core/tcp_in.c
View File

@ -1331,7 +1331,8 @@ tcp_parseopt(struct tcp_pcb *pcb)
opts[c + 1] == 0x04) { opts[c + 1] == 0x04) {
/* An MSS option with the right option length. */ /* An MSS option with the right option length. */
mss = (opts[c + 2] << 8) | opts[c + 3]; mss = (opts[c + 2] << 8) | opts[c + 3];
pcb->mss = mss > TCP_MSS? TCP_MSS: mss; /* Limit the mss to the configured TCP_MSS and prevent division by zero */
pcb->mss = ((mss > TCP_MSS) || (mss == 0)) ? TCP_MSS : mss;
/* And we are done processing options. */ /* And we are done processing options. */
break; break;