D31318.id92962.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D31318.id92962.diff
View Options

	diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
	--- a/sbin/ggate/ggatec/ggatec.c
	+++ b/sbin/ggate/ggatec/ggatec.c
	@@ -144,7 +144,21 @@
	case BIO_WRITE:
	hdr.gh_cmd = GGATE_CMD_WRITE;
	break;
	+ default:
	+ g_gate_log(LOG_NOTICE, "Unknown gctl_cmd: %i", ggio.gctl_cmd);
	+ ggio.gctl_error = EOPNOTSUPP;
	+ g_gate_ioctl(G_GATE_CMD_DONE, &ggio);
	+ continue;
	+ }
	+
	+ /* Don't send requests for more data than we can handle the response for! */
	+ if (ggio.gctl_length > MAXPHYS) {
	+ g_gate_log(LOG_ERR, "Request too big: %zd", ggio.gctl_length);
	+ ggio.gctl_error = EOPNOTSUPP;
	+ g_gate_ioctl(G_GATE_CMD_DONE, &ggio);
	+ continue;
	}
	+
	hdr.gh_seq = ggio.gctl_seq;
	hdr.gh_offset = ggio.gctl_offset;
	hdr.gh_length = ggio.gctl_length;
	@@ -217,6 +231,12 @@
	ggio.gctl_length = hdr.gh_length;
	ggio.gctl_error = hdr.gh_error;

	+ /* Do not overflow our buffer if there is a bogus response. */
	+ if (ggio.gctl_length > (off_t) sizeof(buf)) {
	+ g_gate_log(LOG_ERR, "Received too big response: %zd", ggio.gctl_length);
	+ break;
	+ }
	+
	if (ggio.gctl_error == 0 && ggio.gctl_cmd == GGATE_CMD_READ) {
	data = g_gate_recv(recvfd, ggio.gctl_data,
	ggio.gctl_length, MSG_WAITALL);