lib9p: fix zero msize abort() due to unknown version (thanks kivik)

kivik wrote:

I've found a nasty bug in lib9p handling of Tversion
messages, where an invalid version string in the request
leads to servers abort()ing the spaceship.

To reproduce:
	; ramfs -S ram
	; aux/9pcon /srv/ram
	Tversion ~0 DIE

The issue lies in sversion() where in case an invalid
version string is received we respond right away with
ofcall.version="unknown"; however, we fail to set the
ofcall.msize, which at this point is cleared to 0.  This
causes the convS2M call in respond() to fail and abort being
called.
front
cinap_lenrek 2019-03-01 01:43:55 +01:00
parent 967b1248f8
commit 0aac600fb3
1 changed files with 1 additions and 0 deletions

View File

@ -172,6 +172,7 @@ sversion(Srv *srv, Req *r)
}
if(strncmp(r->ifcall.version, "9P", 2) != 0){
r->ofcall.version = "unknown";
r->ofcall.msize = 256;
respond(r, nil);
return;
}