xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

devtls: reject zero length records (thanks sigrid)

Browse source 
zero length record causes ensure() todo nothing,
while qgrab() assumes there is at least one buffer
in the queue and would dereference the nil buffer.
This commit is contained in:
cinap_lenrek 2021-11-09 00:33:16 +00:00
parent a87ce74d60
commit fccbc30650
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
sys/src/9/port/devtls.c
View file

@ -766,8 +766,8 @@ if(tr->debug)pprint("consumed %d header\n", RecHdrLen);
if(ver != tr->version && (tr->verset || ver < MinProtoVersion || ver > MaxProtoVersion)) if(ver != tr->version && (tr->verset || ver < MinProtoVersion || ver > MaxProtoVersion))
rcvError(tr, EProtocolVersion, "devtls expected ver=%x%s, saw (len=%d) type=%x ver=%x '%.12s'", rcvError(tr, EProtocolVersion, "devtls expected ver=%x%s, saw (len=%d) type=%x ver=%x '%.12s'",
tr->version, tr->verset?"/set":"", len, type, ver, (char*)header); tr->version, tr->verset?"/set":"", len, type, ver, (char*)header);
if(len > MaxCipherRecLen || len < 0) if(len > MaxCipherRecLen || len <= 0)
rcvError(tr, ERecordOverflow, "record message too long %d", len); rcvError(tr, ERecordOverflow, "bad record message length %d", len);
ensure(tr, &tr->unprocessed, len); ensure(tr, &tr->unprocessed, len);
nconsumed = 0; nconsumed = 0;
poperror(); poperror();