Changeset a2fadb4 in code for icbd.c

Timestamp:

Mar 7, 2014, 3:21:30 PM (11 years ago)

Author:

Mike Belopuhov <mike@…>

Branches:

master

Children:

8871953

Parents:

270fd23

git-author:

Mike Belopuhov <mike@…> (03/07/14 15:17:23)

git-committer:

Mike Belopuhov <mike@…> (03/07/14 15:21:30)

Message:

Get rid of ICB_MSGSIZE+1, fix various off-by-ones and do some truncation
where necessary.

File:

• icbd.c (modified) (2 diffs)

icbd.c

@@ -378 +378 @@
 {
         struct icb_session *is = (struct icb_session *)arg;
+        unsigned char length;
 
         while (EVBUFFER_LENGTH(EVBUFFER_INPUT(bev)) > 0) {
                 if (is->length == 0) {
                         /* read length */
-                        is->rlen = bufferevent_read(bev, is->buffer, 1);
-                        is->length = (size_t)(unsigned char)is->buffer[0];
-                        if (is->length == 0) {
+                        bufferevent_read(bev, &length, 1);
+                        if (length == 0) {
+                                /*
+                                 * An extension has been proposed:
+                                 * if length is 0, the packet is part of an
+                                 * "extended packet". The packet should be
+                                 * treated as if length was 255 and the next
+                                 * packet received from the sender should be
+                                 * appended to this packet.
+                                 *
+                                 * This server doesn't support this yet.
+                                 */
                                 icbd_drop(is, "invalid packet");
                                 return;
                         }
+                        is->length = (size_t)length;
+                        is->rlen = 0;
                 }
                 /* read as much as we can */
@@ -406 +418 @@
                 if (is->rlen < is->length)
                         return;
+                /* null-terminate the data */
+                is->buffer[MIN(is->rlen, ICB_MSGSIZE - 1)] = '\0';
                 /* process the message in full */
                 icb_input(is);