Fixes a bug in SACK causing us to send data beyond the receive window.

Found by: Pawel Worach and Daniel Hartmeier
Submitted by: Mohan Srinivasan mohans at yahoo-inc dot com

sys/netinet/tcp_output.c

@@ -310,8 +310,10 @@ tcp_output(struct tcpcb *tp)
 			 * sending new data, having retransmitted all the
 			 * data possible in the scoreboard.
 			 */
-			len = so->so_snd.sb_cc - off;
-			cwin = sendwin - (tp->snd_nxt - tp->sack_newdata) -
+			len = ((long)ulmin(so->so_snd.sb_cc, tp->snd_wnd) 
+			       - off);
+			cwin = tp->snd_cwnd - 
+				(tp->snd_nxt - tp->sack_newdata) -
 				sack_bytes_rxmt;
 			if (cwin < 0)
 				cwin = 0;