ref: edcf7d821652f17d23641dc193f769eb1e02be77
parent: 77b464a5d5648bb646467111b8faf719cd5c46b6
author: cinap_lenrek <cinap_lenrek@felloff.net>
date: Sun Mar 31 12:10:33 EDT 2024
devmnt: handle too short or negative message sizes (sync with 9front) The 9p 4-byte size field must not be smaller than 7 (4+1+2) to have a valid 9p header. Note that len here is signed so this also handles negative values.
--- a/kern/devmnt.c
+++ b/kern/devmnt.c
@@ -821,8 +821,8 @@
/* read in the rest of the message, avoid ridiculous (for now) message sizes */
len = GBIT32(nb->rp);
- if(len > m->msize){- qdiscard(m->q, qlen(m->q));
+ if(len < BIT32SZ+BIT8SZ+BIT16SZ || len > m->msize){+ qflush(m->q);
return -1;
}
if(doread(m, len) < 0)