]> git.proxmox.com Git - mirror_qemu.git/commit - nbd/client.c
nbd: Don't fail handshake on NBD_OPT_LIST descriptions
authorEric Blake <eblake@redhat.com>
Fri, 8 Apr 2016 01:09:37 +0000 (19:09 -0600)
committerMax Reitz <mreitz@redhat.com>
Fri, 15 Apr 2016 15:56:56 +0000 (17:56 +0200)
commit200650d49f558d8394625ef7ee452a093efdb921
treed534ed7efe5cad2237678e5976844777ae70b5c1
parente71fc0bae777e36e6c20271317bd2925628e074f
nbd: Don't fail handshake on NBD_OPT_LIST descriptions

The NBD Protocol states that NBD_REP_SERVER may set
'length > sizeof(namelen) + namelen'; in which case the rest
of the packet is a UTF-8 description of the export.  While we
don't know of any NBD servers that send this description yet,
we had better consume the data so we don't choke when we start
to talk to such a server.

Also, a (buggy/malicious) server that replies with length <
sizeof(namelen) would cause us to block waiting for bytes that
the server is not sending, and one that replies with super-huge
lengths could cause us to temporarily allocate up to 4G memory.
Sanity check things before blindly reading incorrectly.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-id: 1460077777-31004-1-git-send-email-eblake@redhat.com
Reviewed-by: Alex Bligh <alex@alex.org.uk>
Signed-off-by: Max Reitz <mreitz@redhat.com>
nbd/client.c