home  

Bug in trans.TcpSocket

 

 

Emilia Dobkowska from Poland has found a bug in the implementation of the TCP Socket.
The maximum value used for cwnd (congestion window) field was 65536 (0x1000), while it should actually be 65535 (0xFFFF). Using 65536 resulted, when downcast to short type, in cwnd being zero. As a result, TCP stopped sending packets.

The bug is the functions SlowStart() and CongestionAvoidance(): file jist.swans.trans.TcpSocket.java:

private void SlowStart ()
{
   
int temp = cwnd & 0xffff;
   
if ((temp*2) > 65535)
// XXX BUG: 65536, should be 65535
    {       
       
//XXX BUG: Was 65536, should be 65535. Using 65536 resulted in cwnd being 0.
       
//cwnd = (short)65536;
       
cwnd = (short)65535;
    }
else{
       
// every ACK will increase the congestion window by one MSS
       
cwnd = (short)(temp + MSS);
       
if(temp + MSS > 65535) throw new RuntimeException("New cwnd overflows! A bug !!!!");
    }
   
if (PRINTOUT >= FULL_DEBUG)
    {
        System.
out.println ("&&&%%%$$$ NEW CONGESTION WINDOW = " + temp + "(" + cwnd + ")"
);
    }
}

 

The same changes (every 65536 changed to 65535) should be applied to the function jist.swans.trans.TcpSocket.CongestionAvoidance().

 

Gabriel Kliot

01/20/2009