Describe the bug
Location: src/core/cubic.c, line 701
Event.NETWORK_STATISTICS.Bandwidth = Cubic->CongestionWindow / Path->SmoothedRtt;
Root cause: Same division-by-zero pattern as #5833, but in the OnDataAcknowledged function's NetStatsEventEnabled path. If NetStatsEventEnabled is TRUE and an ACK is processed before SmoothedRtt is set, the same crash occurs.
Affected OS
Additional OS information
No response
MsQuic version
main
Steps taken to reproduce bug
- Add the following test in
src/core/unittest/CubicTest.cpp
TEST(CubicTest, DeepTest_Bug_NetStatsEventDivByZero)
{
QUIC_CONNECTION Connection;
QUIC_SETTINGS_INTERNAL Settings{};
Settings.InitialWindowPackets = 10;
Settings.SendIdleTimeoutMs = 1000;
InitializeMockConnection(Connection, 1280);
Connection.Settings.NetStatsEventEnabled = TRUE;
Connection.ClientCallbackHandler = DummyConnectionCallback;
// SmoothedRtt is 0 by default
CubicCongestionControlInitialize(&Connection.CongestionControl, &Settings);
QUIC_CONGESTION_CONTROL_CUBIC* Cubic = &Connection.CongestionControl.Cubic;
Cubic->BytesInFlight = 5000;
QUIC_ACK_EVENT AckEvent;
CxPlatZeroMemory(&AckEvent, sizeof(AckEvent));
AckEvent.TimeNow = 1000000;
AckEvent.LargestAck = 5;
AckEvent.LargestSentPacketNumber = 10;
AckEvent.NumRetransmittableBytes = 1000;
AckEvent.NumTotalAckedRetransmittableBytes = 1000;
AckEvent.SmoothedRtt = 0; // No RTT sample
AckEvent.MinRtt = 0;
AckEvent.MinRttValid = FALSE;
AckEvent.AckedPackets = NULL;
// This will crash with STATUS_INTEGER_DIVIDE_BY_ZERO
// because Path->SmoothedRtt=0 and line 701 does: CongestionWindow / SmoothedRtt
Connection.CongestionControl.QuicCongestionControlOnDataAcknowledged(
&Connection.CongestionControl, &AckEvent);
}
- Build and run the test with filter
CubicTest.DeepTest_Bug_NetStatsEventDivByZero
Expected behavior
Should not crash.
Actual outcome
STATUS_INTEGER_DIVIDE_BY_ZERO crash
Additional details
No response
Describe the bug
Location:
src/core/cubic.c, line 701Event.NETWORK_STATISTICS.Bandwidth = Cubic->CongestionWindow / Path->SmoothedRtt;Root cause: Same division-by-zero pattern as #5833, but in the
OnDataAcknowledgedfunction'sNetStatsEventEnabledpath. IfNetStatsEventEnabledisTRUEand anACKis processed beforeSmoothedRttis set, the same crash occurs.Affected OS
Additional OS information
No response
MsQuic version
main
Steps taken to reproduce bug
src/core/unittest/CubicTest.cppCubicTest.DeepTest_Bug_NetStatsEventDivByZeroExpected behavior
Should not crash.
Actual outcome
STATUS_INTEGER_DIVIDE_BY_ZEROcrashAdditional details
No response