fixed bug #34426: tcp_zero_window_probe() transmits incorrect byte value when pcb...

[pes-rpp/rpp-lwip.git] / src / core / tcp_out.c

diff --git a/src/core/tcp_out.c b/src/core/tcp_out.c
index 1a6ff53b6e93bedbd71d59575b27ac9e1335c6c3..6ad1c1aeeb341327ef2e532ea524a6af2d3cda03 100644 (file)
--- a/src/core/tcp_out.c
+++ b/src/core/tcp_out.c
@@ -1456,9 +1456,11 @@ tcp_zero_window_probe(struct tcp_pcb *pcb)
     TCPH_FLAGS_SET(tcphdr, TCP_ACK | TCP_FIN);
   } else {
     /* Data segment, copy in one byte from the head of the unacked queue */
-    struct tcp_hdr *thdr = (struct tcp_hdr *)seg->p->payload;
     char *d = ((char *)p->payload + TCP_HLEN);
-    pbuf_copy_partial(seg->p, d, 1, TCPH_HDRLEN(thdr) * 4);
+    /* Depending on whether the segment has already been sent (unacked) or not
+       (unsent), seg->p->payload points to the IP header or TCP header.
+       Ensure we copy the first TCP data byte: */
+    pbuf_copy_partial(seg->p, d, 1, seg->p->tot_len - seg->len);
   }
 
 #if CHECKSUM_GEN_TCP