lib9p: fix zero msize abort() due to unknown version (thanks kivik)
kivik wrote: I've found a nasty bug in lib9p handling of Tversion messages, where an invalid version string in the request leads to servers abort()ing the spaceship. To reproduce: ; ramfs -S ram ; aux/9pcon /srv/ram Tversion ~0 DIE The issue lies in sversion() where in case an invalid version string is received we respond right away with ofcall.version="unknown"; however, we fail to set the ofcall.msize, which at this point is cleared to 0. This causes the convS2M call in respond() to fail and abort being called.front
parent
967b1248f8
commit
0aac600fb3
|
@ -172,6 +172,7 @@ sversion(Srv *srv, Req *r)
|
|||
}
|
||||
if(strncmp(r->ifcall.version, "9P", 2) != 0){
|
||||
r->ofcall.version = "unknown";
|
||||
r->ofcall.msize = 256;
|
||||
respond(r, nil);
|
||||
return;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue