diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/socket.asm | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/src/socket.asm b/src/socket.asm index 20ed982..0720b0a 100644 --- a/src/socket.asm +++ b/src/socket.asm @@ -21,10 +21,16 @@ DEF SK_HASRX EQU 9 ; 1 rxbuf holds a datagram DEF SK_RXLEN EQU 10 ; 1 payload length DEF SK_SRCIP EQU 11 ; 4 sender IP DEF SK_SRCPORT EQU 15 ; 2 sender port -DEF SK_RXBUF EQU 17 ; 288 payload (holds a DHCP reply, or a max segment) -DEF SK_STATE EQU 305 ; 1 TCP state (see TCP_* below) -DEF SK_SND EQU 306 ; 4 snd_nxt (our next sequence number) -DEF SK_RCV EQU 310 ; 4 rcv_nxt (next sequence we expect from peer) +; TCP bookkeeping MUST stay below offset 256: the field accessors do +; `add SK_x` as an 8-bit immediate, so any constant >=256 is silently +; truncated (e.g. 305 -> 49) and lands *inside* RXBUF, where an incoming +; segment's payload then overwrites the connection's STATE/seq numbers - +; corrupting every multi-segment TCP receive. Keep STATE/SND/RCV ahead of +; the big RXBUF; RXBUF is only ever based via a 16-bit-safe add. +DEF SK_STATE EQU 17 ; 1 TCP state (see TCP_* below) +DEF SK_SND EQU 18 ; 4 snd_nxt (our next sequence number) +DEF SK_RCV EQU 22 ; 4 rcv_nxt (next sequence we expect from peer) +DEF SK_RXBUF EQU 26 ; 288 payload (holds a DHCP reply, or a max segment) DEF SK_SIZE EQU 314 DEF TCP_MSS EQU 200 |