From 7d5ed1ceea133ba4355a36907d4a5ba423728128 Mon Sep 17 00:00:00 2001
From: Paul Saab <ps@FreeBSD.org>
Date: Mon, 29 Nov 2004 18:47:27 +0000
Subject: [PATCH] Fixes a bug in SACK causing us to send data beyond the
 receive window.

Found by: Pawel Worach and Daniel Hartmeier
Submitted by: Mohan Srinivasan mohans at yahoo-inc dot com
---
 sys/netinet/tcp_output.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index 0e36553b1abe..e761acca8c55 100644
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -310,8 +310,10 @@ tcp_output(struct tcpcb *tp)
 			 * sending new data, having retransmitted all the
 			 * data possible in the scoreboard.
 			 */
-			len = so->so_snd.sb_cc - off;
-			cwin = sendwin - (tp->snd_nxt - tp->sack_newdata) -
+			len = ((long)ulmin(so->so_snd.sb_cc, tp->snd_wnd) 
+			       - off);
+			cwin = tp->snd_cwnd - 
+				(tp->snd_nxt - tp->sack_newdata) -
 				sack_bytes_rxmt;
 			if (cwin < 0)
 				cwin = 0;