From 49b1a614951f940f1c85cf5850419a329957334a Mon Sep 17 00:00:00 2001 From: Dario Nieuwenhuis Date: Tue, 5 Oct 2021 01:24:52 +0200 Subject: [PATCH] tcp: fix "attempt to negate with overflow" when initial seq is 0xFFFF_FFFF. Found with cargo-fuzz. --- src/socket/tcp.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/socket/tcp.rs b/src/socket/tcp.rs index ba0c29d..eca1dbb 100644 --- a/src/socket/tcp.rs +++ b/src/socket/tcp.rs @@ -1592,7 +1592,7 @@ impl<'a> TcpSocket<'a> { self.local_endpoint = IpEndpoint::new(ip_repr.dst_addr(), repr.dst_port); self.remote_endpoint = IpEndpoint::new(ip_repr.src_addr(), repr.src_port); // FIXME: use something more secure here - self.local_seq_no = TcpSeqNumber(-repr.seq_number.0); + self.local_seq_no = TcpSeqNumber(!repr.seq_number.0); self.remote_seq_no = repr.seq_number + 1; self.remote_last_seq = self.local_seq_no; self.remote_has_sack = repr.sack_permitted; @@ -2489,7 +2489,7 @@ mod test { port: REMOTE_PORT, }; const LOCAL_SEQ: TcpSeqNumber = TcpSeqNumber(10000); - const REMOTE_SEQ: TcpSeqNumber = TcpSeqNumber(-10000); + const REMOTE_SEQ: TcpSeqNumber = TcpSeqNumber(-10001); const SEND_IP_TEMPL: IpRepr = IpRepr::Unspecified { src_addr: MOCK_IP_ADDR_1,