shithub: riscv

Info  •  Files  •  Log  •  Branches

devmnt: handle too short or negative message sizes

The 9p 4-byte size field must not be smaller
than 7 (4+1+2) to have a valid 9p header.

Note that len here is signed so this also handles
negative values.

--- a/sys/src/9/port/devmnt.c

+++ b/sys/src/9/port/devmnt.c

@@ -1109,8 +1109,8 @@

 	/* read in the rest of the message, avoid ridiculous (for now) message sizes */

 	len = GBIT32(nb->rp);

-	if(len > m->msize){

-		qdiscard(m->q, qlen(m->q));

+	if(len < BIT32SZ+BIT8SZ+BIT16SZ || len > m->msize){

+		qflush(m->q);

 		return -1;

 	}

 	if(doread(m, len) < 0)