hastd: Fix crash on empty message

A HAST message can be empty, in which case ebuf_add_tail() does nothing
and ebuf_data() returns NULL because the size of the ebuf is zero, but
hast_proto_recv_hdr() asserts that the return value is not NULL,
resulting in an immediate crash if hastctl or hastd receive an empty
message.  This is trivially reproducable by running `hastctl status` or
`hastctl role init` (as the rc script does prior to stopping hastd).

To avoid this, don't try to grow the ebuf or receive additional data
if the header size is zero.

PR:		298085
MFC after:	3 days
Reviewed by:	kevans, gjb
Differential Revision:	https://reviews.freebsd.org/D59306
This commit is contained in:
Glen Barber authored and Dag-Erling Smørgrav committed 2026-09-03 09:58:54 +02:00
1 parent 37aec55d0a
commit 8646d65b45
1 file changed
+8 -6
+8 -6
View File
@@ -150,12 +150,14 @@ hast_proto_recv_hdr(const struct proto_conn *conn, struct nv **nvp)
eb = ebuf_alloc(hdr.size);
if (eb == NULL)
goto fail;
if (ebuf_add_tail(eb, NULL, hdr.size) == -1)
goto fail;
hptr = ebuf_data(eb, NULL);
PJDLOG_ASSERT(hptr != NULL);
if (proto_recv(conn, hptr, hdr.size) == -1)
goto fail;
if (hdr.size > 0) {
if (ebuf_add_tail(eb, NULL, hdr.size) == -1)
goto fail;
hptr = ebuf_data(eb, NULL);
PJDLOG_ASSERT(hptr != NULL);
if (proto_recv(conn, hptr, hdr.size) == -1)
goto fail;
}
nv = nv_ntoh(eb);
if (nv == NULL)
goto fail;