lib9p: fix zero msize abort() due to unknown version (thanks kivik)
kivik wrote: I've found a nasty bug in lib9p handling of Tversion messages, where an invalid version string in the request leads to servers abort()ing the spaceship. To reproduce: ; ramfs -S ram ; aux/9pcon /srv/ram Tversion ~0 DIE The issue lies in sversion() where in case an invalid version string is received we respond right away with ofcall.version="unknown"; however, we fail to set the ofcall.msize, which at this point is cleared to 0. This causes the convS2M call in respond() to fail and abort being called.
This commit is contained in:
parent
967b1248f8
commit
0aac600fb3
1 changed files with 1 additions and 0 deletions
|
@ -172,6 +172,7 @@ sversion(Srv *srv, Req *r)
|
|||
}
|
||||
if(strncmp(r->ifcall.version, "9P", 2) != 0){
|
||||
r->ofcall.version = "unknown";
|
||||
r->ofcall.msize = 256;
|
||||
respond(r, nil);
|
||||
return;
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue