diff options
| author | cinap_lenrek <cinap_lenrek@felloff.net> | 2021-11-09 01:46:13 +0000 |
|---|---|---|
| committer | cinap_lenrek <cinap_lenrek@felloff.net> | 2021-11-09 01:46:13 +0000 |
| commit | a4c1f3cc18df6fddd548f4df9f209695c4eb7263 (patch) | |
| tree | b7b5f27c8cd1ab272561280cfa073a935bf15ac3 | |
| parent | 68572ab45102118db695ab1bcc935b9b3b95c7ca (diff) | |
devtls: reject zero length records (thanks sigrid)
zero length record causes ensure() todo nothing,
while qgrab() assumes there is at least one buffer
in the queue and would dereference the nil buffer.
| -rw-r--r-- | sys/src/9/port/devtls.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/src/9/port/devtls.c b/sys/src/9/port/devtls.c index 4b691c50e..e4974ec77 100644 --- a/sys/src/9/port/devtls.c +++ b/sys/src/9/port/devtls.c @@ -766,8 +766,8 @@ if(tr->debug)pprint("consumed %d header\n", RecHdrLen); if(ver != tr->version && (tr->verset || ver < MinProtoVersion || ver > MaxProtoVersion)) rcvError(tr, EProtocolVersion, "devtls expected ver=%x%s, saw (len=%d) type=%x ver=%x '%.12s'", tr->version, tr->verset?"/set":"", len, type, ver, (char*)header); - if(len > MaxCipherRecLen || len < 0) - rcvError(tr, ERecordOverflow, "record message too long %d", len); + if(len > MaxCipherRecLen || len <= 0) + rcvError(tr, ERecordOverflow, "bad record message length %d", len); ensure(tr, &tr->unprocessed, len); nconsumed = 0; poperror(); |