mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-11-30 07:11:04 +01:00
Code Issues Projects Releases Wiki Activity

[BUG] stream_sock: wrong max computation on recv

Browse Source 
Since the introduction of the automatic sizing of buffers during reads,
a bug appeared where the max size could be negative, causing large
chunks of memory to be overwritten during recv() calls if a read pointer
was already past the buffer's limit.
This commit is contained in:
Willy Tarreau 2009-12-28 17:36:37 +01:00
parent 58cc872848
commit 864e8256ec
1 changed files with 12 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/stream_sock.c
View File

@ -296,28 +296,27 @@ int stream_sock_read(int fd) {
#endif #endif
cur_read = 0; cur_read = 0;
while (1) { while (1) {
max = buffer_max_len(b) - b->l;
if (max <= 0) {
b->flags |= BF_FULL;
si->flags |= SI_FL_WAIT_ROOM;
break;
}
/* /*
* 1. compute the maximum block size we can read at once. * 1. compute the maximum block size we can read at once.
*/ */
if (b->l == 0) { if (b->l == 0) {
/* let's realign the buffer to optimize I/O */ /* let's realign the buffer to optimize I/O */
b->r = b->w = b->lr = b->data; b->r = b->w = b->lr = b->data;
max = buffer_max_len(b);
} }
else if (b->r > b->w) { else if (b->r > b->w) {
max = b->data + buffer_max_len(b) - b->r; /* remaining space wraps at the end, with a moving limit */
} if (max > b->data + b->size - b->r)
else { max = b->data + b->size - b->r;
max = b->w - b->r;
if (max > buffer_max_len(b))
max = buffer_max_len(b);
}
if (max == 0) {
b->flags |= BF_FULL;
si->flags |= SI_FL_WAIT_ROOM;
break;
} }
/* else max is already OK */
/* /*
* 2. read the largest possible block * 2. read the largest possible block