xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

devtls: reject zero length records (thanks sigrid)

Browse source 
zero length record causes ensure() todo nothing,
while qgrab() assumes there is at least one buffer
in the queue and would dereference the nil buffer.
This commit is contained in:
cinap_lenrek 2021-11-09 01:46:13 +00:00
parent 68572ab451
commit a4c1f3cc18
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
sys/src/9/port/devtls.c
View file

@ -766,8 +766,8 @@ if(tr->debug)pprint("consumed %d header\n", RecHdrLen);
if(ver != tr->version && (tr->verset || ver < MinProtoVersion || ver > MaxProtoVersion))
rcvError(tr, EProtocolVersion, "devtls expected ver=%x%s, saw (len=%d) type=%x ver=%x '%.12s'",
tr->version, tr->verset?"/set":"", len, type, ver, (char*)header);
if(len > MaxCipherRecLen || len < 0)
rcvError(tr, ERecordOverflow, "record message too long %d", len);
if(len > MaxCipherRecLen || len <= 0)
rcvError(tr, ERecordOverflow, "bad record message length %d", len);
ensure(tr, &tr->unprocessed, len);
nconsumed = 0;
poperror();