diff options
| author | cinap_lenrek <cinap_lenrek@gmx.de> | 2013-01-30 06:28:42 +0100 |
|---|---|---|
| committer | cinap_lenrek <cinap_lenrek@gmx.de> | 2013-01-30 06:28:42 +0100 |
| commit | 3787f721c1efe19c0502dc7e429459804100757d (patch) | |
| tree | 2f13a3f87496668b131eff4025d62b8dfdf4ac2e /sys/src/cmd/unix | |
| parent | dbbbff89151794c838319e831254bcff6b3dbbcf (diff) | |
9p message size too small
various fileservers do not check if the message size is too small
(they subtract IOHDRSZ later from it to calculate iounit) which
can overflow.
Diffstat (limited to 'sys/src/cmd/unix')
| -rw-r--r-- | sys/src/cmd/unix/u9fs/u9fs.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/src/cmd/unix/u9fs/u9fs.c b/sys/src/cmd/unix/u9fs/u9fs.c index eeee21f12..b98ced8ba 100644 --- a/sys/src/cmd/unix/u9fs/u9fs.c +++ b/sys/src/cmd/unix/u9fs/u9fs.c @@ -355,6 +355,10 @@ serve(int rfd, int wfd) void rversion(Fcall *rx, Fcall *tx) { + if(rx->msize < 256){ + seterror(tx, "version: message size too small"); + return; + } if(msize > rx->msize) msize = rx->msize; tx->msize = msize; |