shithub: riscv

Info  •  Files  •  Log  •  Branches

aan: check negative message size in header

--- a/sys/src/cmd/aan.c

+++ b/sys/src/cmd/aan.c

@@ -310,14 +310,11 @@

 			len, n, m, acked, lastacked);

 		if (n == 0) {

-			if (m >= 0) {

-				dmessage(1, "fromnet; network closed\n");

-				break;

-			}

-			continue;

-		}

-

-		if (n > Bufsize) {

+			if (m < 0)

+				continue;

+			dmessage(1, "fromnet; network closed\n");

+			break;

+		} else if (n < 0 || n > Bufsize) {

 			dmessage(1, "fromnet; message too big %d > %d\n", n, Bufsize);

 			break;

 		}

@@ -337,6 +334,7 @@

 			dmessage(1, "fromnet; skipping message %d, currently at %d\n", m, inmsg);

 			continue;

 		}			

+		inmsg++;

 		// Process the acked list.

 		while(lastacked != acked) {

@@ -352,7 +350,6 @@

 			sendp(empty, rb);

 			lastacked++;

 		} 

-		inmsg++;

 		showmsg(1, "fromnet", b);

-- 

⑨