diff options
| author | user <user@clank> | 2026-07-17 20:22:07 +0200 |
|---|---|---|
| committer | user <user@clank> | 2026-07-17 20:22:07 +0200 |
| commit | d94b18652ddfb264aa9a34514ea790230d80bcc2 (patch) | |
| tree | fd7de936064289ac064070238bd2118e296c73c0 /include/gbos.inc | |
| parent | docs: link-drop investigation resolved - drops are self-healing now (diff) | |
| download | gbos-d94b18652ddfb264aa9a34514ea790230d80bcc2.tar.gz gbos-d94b18652ddfb264aa9a34514ea790230d80bcc2.tar.xz gbos-d94b18652ddfb264aa9a34514ea790230d80bcc2.zip | |
net: fix truncated TCP field offsets corrupting multi-segment recv
SK_STATE/SK_SND/SK_RCV sat at struct offsets 305/306/310, past the
288-byte SK_RXBUF. But the field accessors add the offset as an 8-bit
immediate (add SK_x; ld l,a), so rgbasm truncated 305->49, 306->50,
310->54 (the -Wtruncation warnings we'd been ignoring) - putting STATE
and the sequence numbers *inside* RXBUF at offsets 49/50/54.
Any TCP segment with >=33 payload bytes therefore overwrote the
connection's own STATE and rcv_nxt/snd_nxt with message text. The first
segment of a stream landed, its data clobbered STATE to a garbage value,
and every subsequent segment was dropped because tcp_in no longer saw
ESTABLISHED - so multi-segment TCP receives (an IRC MOTD, any HTTP body
past one segment) silently stalled. wget appeared to 'work' only because
a single-segment reply plus a never-honored FIN still printed once.
Fix: reorder the struct so STATE/SND/RCV precede the big RXBUF, keeping
every field offset < 256 (SK_SIZE unchanged at 314, all accessors are
symbolic). Zero -Wtruncation warnings remain. Verified an 11-line IRC
registration burst now arrives intact.
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions
