lib9p: fix zero msize abort() due to unknown version (thanks kivik)

kivik wrote:

I've found a nasty bug in lib9p handling of Tversion
messages, where an invalid version string in the request
leads to servers abort()ing the spaceship.

To reproduce:
	; ramfs -S ram
	; aux/9pcon /srv/ram
	Tversion ~0 DIE

The issue lies in sversion() where in case an invalid
version string is received we respond right away with
ofcall.version="unknown"; however, we fail to set the
ofcall.msize, which at this point is cleared to 0.  This
causes the convS2M call in respond() to fail and abort being
called.
This commit is contained in:
cinap_lenrek 2019-03-01 01:43:55 +01:00
parent 967b1248f8
commit 0aac600fb3

View file

@ -172,6 +172,7 @@ sversion(Srv *srv, Req *r)
}
if(strncmp(r->ifcall.version, "9P", 2) != 0){
r->ofcall.version = "unknown";
r->ofcall.msize = 256;
respond(r, nil);
return;
}