[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[Nbd] [PATCH v2 2/6] server: Fix botched strlen computation of error message



Commit 3b80382 tried to make it easy for the server to send an
error message whose length was determined by strlen(), but ended
up sending a length of UINT32_MAX, causing clients to either
hang up (reply too large) or wait for nearly 4G of data that was
never coming.

Signed-off-by: Eric Blake <eblake@...696...>
---
 nbd-server.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/nbd-server.c b/nbd-server.c
index 25c335b..d0c6fa6 100644
--- a/nbd-server.c
+++ b/nbd-server.c
@@ -1321,11 +1321,12 @@ static void send_reply(CLIENT* client, uint32_t opt, uint32_t reply_type, ssize_
 		htonl(reply_type),
 		htonl(datasize),
 	};
+	if(datasize < 0) {
+		datasize = strlen((char*)data);
+		header.datasize = htonl(datasize);
+	}
 	socket_write(client, &header, sizeof(header));
 	if(datasize != 0) {
-		if(datasize < 0) {
-			datasize = strlen((char*)data);
-		}
 		socket_write(client, data, datasize);
 	}
 }
-- 
2.7.4




Reply to: