Module Name: src Committed By: martin Date: Wed Jan 4 15:09:37 UTC 2017
Modified Files: src/sys/netinet: tcp_output.c Log Message: Fix optlen calculation for the SACK block - 2 bytes too few were calculated, causing corruption in PR kern/51767. To generate a diff of this commit: cvs rdiff -u -r1.193 -r1.194 src/sys/netinet/tcp_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/netinet/tcp_output.c diff -u src/sys/netinet/tcp_output.c:1.193 src/sys/netinet/tcp_output.c:1.194 --- src/sys/netinet/tcp_output.c:1.193 Wed Jan 4 12:35:14 2017 +++ src/sys/netinet/tcp_output.c Wed Jan 4 15:09:37 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: tcp_output.c,v 1.193 2017/01/04 12:35:14 kre Exp $ */ +/* $NetBSD: tcp_output.c,v 1.194 2017/01/04 15:09:37 martin Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -135,7 +135,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.193 2017/01/04 12:35:14 kre Exp $"); +__KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.194 2017/01/04 15:09:37 martin Exp $"); #ifdef _KERNEL_OPT #include "opt_inet.h" @@ -1267,7 +1267,7 @@ send: *lp++ = htonl(tiqe->ipqe_seq + tiqe->ipqe_len + ((tiqe->ipqe_flags & TH_FIN) != 0 ? 1 : 0)); } - optlen += sack_len; + optlen += sack_len + 2; optp += sack_len; } else { optp -= alen;