From: Simon Goldschmidt <goldsimon@gmx.de>
Date: Sun, 9 Oct 2011 18:11:33 +0000 (+0200)
Subject: fixed bug #34426: tcp_zero_window_probe() transmits incorrect byte value when pcb... 
X-Git-Url: http://rtime.felk.cvut.cz/gitweb/pes-rpp/rpp-lwip.git/commitdiff_plain/f29bdd21a778eef253f037aae444f61db7f3cc36

fixed bug #34426: tcp_zero_window_probe() transmits incorrect byte value when pcb->unacked != NULL
---

diff --git a/CHANGELOG b/CHANGELOG
index c88026e9..2f844e44 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -69,6 +69,10 @@ HISTORY
 
  ++ Bugfixes:
 
+  2011-10-09: Simon Goldschmidt
+  * tcp_out.c: fixed bug #34426: tcp_zero_window_probe() transmits incorrect
+    byte value when pcb->unacked != NULL
+
   2011-10-09: Simon Goldschmidt
   * ip4.c: fixed bug #34447 LWIP_IP_ACCEPT_UDP_PORT(dst_port) wrong
 
diff --git a/src/core/tcp_out.c b/src/core/tcp_out.c
index 1a6ff53b..6ad1c1ae 100644
--- a/src/core/tcp_out.c
+++ b/src/core/tcp_out.c
@@ -1456,9 +1456,11 @@ tcp_zero_window_probe(struct tcp_pcb *pcb)
     TCPH_FLAGS_SET(tcphdr, TCP_ACK | TCP_FIN);
   } else {
     /* Data segment, copy in one byte from the head of the unacked queue */
-    struct tcp_hdr *thdr = (struct tcp_hdr *)seg->p->payload;
     char *d = ((char *)p->payload + TCP_HLEN);
-    pbuf_copy_partial(seg->p, d, 1, TCPH_HDRLEN(thdr) * 4);
+    /* Depending on whether the segment has already been sent (unacked) or not
+       (unsent), seg->p->payload points to the IP header or TCP header.
+       Ensure we copy the first TCP data byte: */
+    pbuf_copy_partial(seg->p, d, 1, seg->p->tot_len - seg->len);
   }
 
 #if CHECKSUM_GEN_TCP