Date: Mon, 13 Jul 1998 04:54:01 -0700 (PDT) From: Bruce Evans <bde@FreeBSD.ORG> To: cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG, cvs-sys@FreeBSD.ORG Subject: cvs commit: src/sys/netinet tcp_output.c Message-ID: <199807131154.EAA20311@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
bde 1998/07/13 04:54:01 PDT
Modified files:
sys/netinet tcp_output.c
Log:
Fixed overflow and sign extension bugs in
`len = min(so->so_snd.sb_cc, win) - off;'. min() has type u_int
and `off' has type int, so when min() is 0 and `off' is 1, the RHS
overflows to 0U - 1 = UINT_MAX. `len' has type long, so when
sizeof(long) == sizeof(int), the LHS normally overflows to to the
correct value of -1, but when sizeof(long) > sizeof(int), the LHS
is UINT_MAX.
Fixed some u_long's that should have been fixed-sized types.
Revision Changes Path
1.31 +4 -4 src/sys/netinet/tcp_output.c
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199807131154.EAA20311>