From owner-cvs-all  Mon Jul 13 04:54:31 1998
Return-Path: <owner-cvs-all@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id EAA20756
          for cvs-all-outgoing; Mon, 13 Jul 1998 04:54:31 -0700 (PDT)
          (envelope-from owner-cvs-all@FreeBSD.ORG)
Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id EAA20751;
          Mon, 13 Jul 1998 04:54:28 -0700 (PDT)
          (envelope-from bde@FreeBSD.org)
From: Bruce Evans <bde@FreeBSD.ORG>
Received: (from bde@localhost)
	by freefall.freebsd.org (8.8.8/8.8.5) id EAA20311;
	Mon, 13 Jul 1998 04:54:01 -0700 (PDT)
Date: Mon, 13 Jul 1998 04:54:01 -0700 (PDT)
Message-Id: <199807131154.EAA20311@freefall.freebsd.org>
To: cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG, cvs-sys@FreeBSD.ORG
Subject: cvs commit: src/sys/netinet tcp_output.c
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk

bde         1998/07/13 04:54:01 PDT

  Modified files:
    sys/netinet          tcp_output.c 
  Log:
  Fixed overflow and sign extension bugs in
  `len = min(so->so_snd.sb_cc, win) - off;'.  min() has type u_int
  and `off' has type int, so when min() is 0 and `off' is 1, the RHS
  overflows to 0U - 1 = UINT_MAX.  `len' has type long, so when
  sizeof(long) == sizeof(int), the LHS normally overflows to to the
  correct value of -1, but when sizeof(long) > sizeof(int), the LHS
  is UINT_MAX.
  
  Fixed some u_long's that should have been fixed-sized types.
  
  Revision  Changes    Path
  1.31      +4 -4      src/sys/netinet/tcp_output.c

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message