• E
    nbd: Don't fail handshake on NBD_OPT_LIST descriptions · 200650d4
    Eric Blake 提交于
    The NBD Protocol states that NBD_REP_SERVER may set
    'length > sizeof(namelen) + namelen'; in which case the rest
    of the packet is a UTF-8 description of the export.  While we
    don't know of any NBD servers that send this description yet,
    we had better consume the data so we don't choke when we start
    to talk to such a server.
    
    Also, a (buggy/malicious) server that replies with length <
    sizeof(namelen) would cause us to block waiting for bytes that
    the server is not sending, and one that replies with super-huge
    lengths could cause us to temporarily allocate up to 4G memory.
    Sanity check things before blindly reading incorrectly.
    Signed-off-by: NEric Blake <eblake@redhat.com>
    Message-id: 1460077777-31004-1-git-send-email-eblake@redhat.com
    Reviewed-by: NAlex Bligh <alex@alex.org.uk>
    Signed-off-by: NMax Reitz <mreitz@redhat.com>
    200650d4
client.c 20.8 KB