mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-28 11:25:21 +01:00
hastd: Fix crash on empty message
A HAST message can be empty, in which case ebuf_add_tail() does nothing and ebuf_data() returns NULL because the size of the ebuf is zero, but hast_proto_recv_hdr() asserts that the return value is not NULL, resulting in an immediate crash if hastctl or hastd receive an empty message. This is trivially reproducable by running `hastctl status` or `hastctl role init` (as the rc script does prior to stopping hastd). To avoid this, don't try to grow the ebuf or receive additional data if the header size is zero. PR: 298085 MFC after: 3 days Reviewed by: kevans, gjb Differential Revision: https://reviews.freebsd.org/D59306
This commit is contained in:
1 parent
37aec55d0a
commit
8646d65b45
1 file changed
+8
-6
@@ -150,12 +150,14 @@ hast_proto_recv_hdr(const struct proto_conn *conn, struct nv **nvp)
|
||||
eb = ebuf_alloc(hdr.size);
|
||||
if (eb == NULL)
|
||||
goto fail;
|
||||
if (ebuf_add_tail(eb, NULL, hdr.size) == -1)
|
||||
goto fail;
|
||||
hptr = ebuf_data(eb, NULL);
|
||||
PJDLOG_ASSERT(hptr != NULL);
|
||||
if (proto_recv(conn, hptr, hdr.size) == -1)
|
||||
goto fail;
|
||||
if (hdr.size > 0) {
|
||||
if (ebuf_add_tail(eb, NULL, hdr.size) == -1)
|
||||
goto fail;
|
||||
hptr = ebuf_data(eb, NULL);
|
||||
PJDLOG_ASSERT(hptr != NULL);
|
||||
if (proto_recv(conn, hptr, hdr.size) == -1)
|
||||
goto fail;
|
||||
}
|
||||
nv = nv_ntoh(eb);
|
||||
if (nv == NULL)
|
||||
goto fail;
|
||||
|
||||
Reference in new issue
Block a user