RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-02-08 22:37:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

[BUG] stream_sock: wrong max computation on recv

Browse Source 
Since the introduction of the automatic sizing of buffers during reads,
a bug appeared where the max size could be negative, causing large
chunks of memory to be overwritten during recv() calls if a read pointer
was already past the buffer's limit.
This commit is contained in:
Willy Tarreau 2009-12-28 17:36:37 +01:00
parent 58cc872848
commit 864e8256ec
1 changed files with 12 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/stream_sock.c
View File

@ -296,28 +296,27 @@ int stream_sock_read(int fd) {
#endif
cur_read = 0;
while (1) {
max = buffer_max_len(b) - b->l;
if (max <= 0) {
b->flags |= BF_FULL;
si->flags |= SI_FL_WAIT_ROOM;
break;
}
/*
* 1. compute the maximum block size we can read at once.
*/
if (b->l == 0) {
/* let's realign the buffer to optimize I/O */
b->r = b->w = b->lr = b->data;
max = buffer_max_len(b);
}
else if (b->r > b->w) {
max = b->data + buffer_max_len(b) - b->r;
}
else {
max = b->w - b->r;
if (max > buffer_max_len(b))
max = buffer_max_len(b);
}
if (max == 0) {
b->flags |= BF_FULL;
si->flags |= SI_FL_WAIT_ROOM;
break;
/* remaining space wraps at the end, with a moving limit */
if (max > b->data + b->size - b->r)
max = b->data + b->size - b->r;
}
/* else max is already OK */
/*
* 2. read the largest possible block