Changeset 13646

Timestamp:

Dec 11, 2012, 4:08:26 AM (8 years ago)

Author:

jordan

Message:

(trunk, libutp) #5002 'crash in UTP_ProcessIncoming()' -- patch ef69847aaa from upstream

File:

• trunk/third-party/libutp/utp.cpp (modified) (4 diffs)

trunk/third-party/libutp/utp.cpp

@@ -1488 +1488 @@
 }
 
+enum { MAX_EACK = 128 };
+
 void UTPSocket::selective_ack(uint base, const byte *mask, byte len)
 {
@@ -1500 +1502 @@
         // iterate in reverse over the acked packets, at the end, the top packets
         // are the ones we want to resend
-        int resends[32];
+        int resends[MAX_EACK];
         int nr = 0;
 
@@ -1573 +1575 @@
                         count >= DUPLICATE_ACKS_BEFORE_RESEND &&
                         duplicate_ack < DUPLICATE_ACKS_BEFORE_RESEND) {
+                        // resends is a stack, and we're mostly interested in the top of it
+                        // if we're full, just throw away the lower half
+                        if (nr >= MAX_EACK - 2) {
+                                memmove(resends, &resends[MAX_EACK/2], MAX_EACK/2 * sizeof(resends[0]));
+                                nr -= MAX_EACK / 2;
+                        }
                         resends[nr++] = v;
                         LOG_UTPV("0x%08x: no ack for %u", this, v);
@@ -1581 +1589 @@
         } while (--bits >= -1);
 
-        if (((base - 1 - fast_resend_seq_nr) & ACK_NR_MASK) < 256 &&
-                count >= DUPLICATE_ACKS_BEFORE_RESEND &&
-                duplicate_ack < DUPLICATE_ACKS_BEFORE_RESEND) {
+        if (((base - 1 - fast_resend_seq_nr) & ACK_NR_MASK) <= OUTGOING_BUFFER_MAX_SIZE &&
+                count >= DUPLICATE_ACKS_BEFORE_RESEND) {
                 // if we get enough duplicate acks to start
                 // resending, the first packet we should resend
                 // is base-1
-                resends[nr++] = base - 1;
+                resends[nr++] = (base - 1) & ACK_NR_MASK;
         } else {
                 LOG_UTPV("0x%08x: not resending %u count:%d dup_ack:%u fast_resend_seq_nr:%u",