Explorar el Código

tcp: fix _wbufq_insert bug

When _wbufq_insert was called on a connection that had already
some data added to the write buffer (another process was faster
and added some data before the process that created the connection
had a chance to do it), a wrong size was used in a memmove.
This could lead either to corrupted messages or even crashes (if
 the messages were big enough to cause a buffer overflow).

Many thanks to Jijo for debugging it.

Reported-by: Jijo
Andrei Pelinescu-Onciul hace 13 años
padre
commit
745e30c923
Se han modificado 1 ficheros con 1 adiciones y 1 borrados
  1. 1 1
      tcp_main.c

+ 1 - 1
tcp_main.c

@@ -808,7 +808,7 @@ inline static int _wbufq_insert(struct  tcp_connection* c, const char* data,
 	}
 	}
 	if ((q->first==q->last) && ((q->last->b_size-q->last_used)>=size)){
 	if ((q->first==q->last) && ((q->last->b_size-q->last_used)>=size)){
 		/* one block with enough space in it for size bytes */
 		/* one block with enough space in it for size bytes */
-		memmove(q->first->buf+size, q->first->buf, size);
+		memmove(q->first->buf+size, q->first->buf, q->last_used);
 		memcpy(q->first->buf, data, size);
 		memcpy(q->first->buf, data, size);
 		q->last_used+=size;
 		q->last_used+=size;
 	}else{
 	}else{