Changeset 14577 in vbox for trunk/src/VBox/Devices/Network

Timestamp:

Nov 25, 2008 3:12:54 PM (16 years ago)

Author:

vboxsync

Message:

slirp: attempt to fix memory corruption

File:

• trunk/src/VBox/Devices/Network/slirp/tcp_input.c (modified) (4 diffs)

trunk/src/VBox/Devices/Network/slirp/tcp_input.c

@@ -422 +422 @@
         u_long tiwin;
 /*      int ts_present = 0; */
-        int mbuf_freed = 0;
 
         DEBUG_CALL("tcp_input");
@@ -1481 +1480 @@
 
         /*
+         * If this is a small packet, then ACK now - with Nagel
+         *      congestion avoidance sender won't send more until
+         *      he gets an ACK.
+         *
+         * See above.
+         */
+        if (ti->ti_len && (unsigned)ti->ti_len <= 5 &&
+            ((struct tcpiphdr_2 *)ti)->first_char == (char)27) {
+                tp->t_flags |= TF_ACKNOW;
+        }
+
+        /*
          * Process the segment text, merging it into the TCP sequencing queue,
          * and arranging for acknowledgment of receipt if necessary.
@@ -1518 +1529 @@
                 len = so->so_rcv.sb_datalen - (tp->rcv_adv - tp->rcv_nxt);
         } else {
-                mbuf_freed = 1; /* The mbuf must be freed, but only when its content is not needed anymore. */
+                m_free(pData, m);
                 tiflags &= ~TH_FIN;
         }
@@ -1586 +1597 @@
         }
 
-        /*
-         * If this is a small packet, then ACK now - with Nagel
-         *      congestion avoidance sender won't send more until
-         *      he gets an ACK.
-         *
-         * See above.
-         */
-/*      if (ti->ti_len && (unsigned)ti->ti_len < tp->t_maxseg) {
- */
-/*      if ((ti->ti_len && (unsigned)ti->ti_len < tp->t_maxseg &&
- *              (so->so_iptos & IPTOS_LOWDELAY) == 0) ||
- *             ((so->so_iptos & IPTOS_LOWDELAY) &&
- *             ((struct tcpiphdr_2 *)ti)->first_char == (char)27)) {
- */
-        if (ti->ti_len && (unsigned)ti->ti_len <= 5 &&
-            ((struct tcpiphdr_2 *)ti)->first_char == (char)27) {
-                tp->t_flags |= TF_ACKNOW;
-        }
-
-        if (mbuf_freed) {
-                m_free(pData, m);
-        }
         /*
          * Return any desired output.