fixed bug #34426: tcp_zero_window_probe() transmits incorrect byte value when pcb...

diff --git a/CHANGELOG b/CHANGELOG
index c88026e9cab88415462a5f24c89f16a017c044bf..2f844e44f1185e05359fa771e5a8349d11768bcc 100644 (file)
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -69,6 +69,10 @@ HISTORY
 
  ++ Bugfixes:
 
+  2011-10-09: Simon Goldschmidt
+  * tcp_out.c: fixed bug #34426: tcp_zero_window_probe() transmits incorrect
+    byte value when pcb->unacked != NULL
+
   2011-10-09: Simon Goldschmidt
   * ip4.c: fixed bug #34447 LWIP_IP_ACCEPT_UDP_PORT(dst_port) wrong
 

diff --git a/src/core/tcp_out.c b/src/core/tcp_out.c
index 1a6ff53b6e93bedbd71d59575b27ac9e1335c6c3..6ad1c1aeeb341327ef2e532ea524a6af2d3cda03 100644 (file)
--- a/src/core/tcp_out.c
+++ b/src/core/tcp_out.c
@@ -1456,9 +1456,11 @@ tcp_zero_window_probe(struct tcp_pcb *pcb)
     TCPH_FLAGS_SET(tcphdr, TCP_ACK | TCP_FIN);
   } else {
     /* Data segment, copy in one byte from the head of the unacked queue */
-    struct tcp_hdr *thdr = (struct tcp_hdr *)seg->p->payload;
     char *d = ((char *)p->payload + TCP_HLEN);
-    pbuf_copy_partial(seg->p, d, 1, TCPH_HDRLEN(thdr) * 4);
+    /* Depending on whether the segment has already been sent (unacked) or not
+       (unsent), seg->p->payload points to the IP header or TCP header.
+       Ensure we copy the first TCP data byte: */
+    pbuf_copy_partial(seg->p, d, 1, seg->p->tot_len - seg->len);
   }
 
 #if CHECKSUM_GEN_TCP