-
Notifications
You must be signed in to change notification settings - Fork 657
Labels
Description
Describe the bug
Location: src/core/cubic.c, line 701
Event.NETWORK_STATISTICS.Bandwidth = Cubic->CongestionWindow / Path->SmoothedRtt;
Root cause: Same division-by-zero pattern as #5833, but in the OnDataAcknowledged function's NetStatsEventEnabled path. If NetStatsEventEnabled is TRUE and an ACK is processed before SmoothedRtt is set, the same crash occurs.
Affected OS
- Windows
- Linux
- macOS
- Other (specify below)
Additional OS information
No response
MsQuic version
main
Steps taken to reproduce bug
- Add the following test in
src/core/unittest/CubicTest.cpp
TEST(CubicTest, DeepTest_Bug_NetStatsEventDivByZero)
{
QUIC_CONNECTION Connection;
QUIC_SETTINGS_INTERNAL Settings{};
Settings.InitialWindowPackets = 10;
Settings.SendIdleTimeoutMs = 1000;
InitializeMockConnection(Connection, 1280);
Connection.Settings.NetStatsEventEnabled = TRUE;
Connection.ClientCallbackHandler = DummyConnectionCallback;
// SmoothedRtt is 0 by default
CubicCongestionControlInitialize(&Connection.CongestionControl, &Settings);
QUIC_CONGESTION_CONTROL_CUBIC* Cubic = &Connection.CongestionControl.Cubic;
Cubic->BytesInFlight = 5000;
QUIC_ACK_EVENT AckEvent;
CxPlatZeroMemory(&AckEvent, sizeof(AckEvent));
AckEvent.TimeNow = 1000000;
AckEvent.LargestAck = 5;
AckEvent.LargestSentPacketNumber = 10;
AckEvent.NumRetransmittableBytes = 1000;
AckEvent.NumTotalAckedRetransmittableBytes = 1000;
AckEvent.SmoothedRtt = 0; // No RTT sample
AckEvent.MinRtt = 0;
AckEvent.MinRttValid = FALSE;
AckEvent.AckedPackets = NULL;
// This will crash with STATUS_INTEGER_DIVIDE_BY_ZERO
// because Path->SmoothedRtt=0 and line 701 does: CongestionWindow / SmoothedRtt
Connection.CongestionControl.QuicCongestionControlOnDataAcknowledged(
&Connection.CongestionControl, &AckEvent);
}- Build and run the test with filter
CubicTest.DeepTest_Bug_NetStatsEventDivByZero
Expected behavior
Should not crash.
Actual outcome
STATUS_INTEGER_DIVIDE_BY_ZERO crash
Additional details
No response
Reactions are currently unavailable
Metadata
Metadata
Labels
Type
Projects
Status
No status