[Nbd] Buffer overwrite bug in nbd-server

[Kurt Fitzner <kfitzner@...75...>]

There is a buffer size bug in the nbd server from at least version 2.7.5
and on.

The buffer size is exactly one megabyte, but nbd-server will accept
requests that are the buffer size.  The problem is, the server makes no
allowance that the buffer must also hold the reply header.  A read
request that is exactly one megabyte will write past the end of the
buffer by the size of the reply header.

The allocation of the buffer needs to be BUFSIZE + sizeof(struct nbd_reply).

I would also like to make the following suggestions:
- The request buffer be malloc'ed instead of grabbed from the stack.
One megabyte is a big chunk of real estate to take from the stack - if
people increase that size, you could end up exceeding the stack size.
- A recent copy of nbd.h be supplied for use in nbd-server so that you
can build the server on 2.4 machines.  There are still major
distributions (Slackware I know for a fact, there may be others) that
use 2.4 kernels.


	Kurt