search for: opt_meta_invalid_option_len

...ntinue; + } + + /* Minimum length of the option payload is the 32 bit export + * name plus a zero length export name plus 32 bit number of + * queries followed by no queries. + */ + what = "optlen < 8"; + if (optlen < 8) { + opt_meta_invalid_option_len: + debug ("newstyle negotiation: %s: invalid option length: %s", + optname, what); + + if (send_newstyle_option_reply (conn, option, NBD_REP_ERR_INVALID) + == -1) + return -1; + continue; + } + + /* Discard t...

.../* Minimum length of the option payload is: - * 32 bit export name length followed by empty export name - * + 32 bit number of queries followed by no queries - * = 8 bytes. - */ - what = "optlen < 8"; - if (optlen < 8) { - opt_meta_invalid_option_len: - debug ("newstyle negotiation: %s: invalid option length: %s", - optname, what); - - if (send_newstyle_option_reply (conn, option, NBD_REP_ERR_INVALID) - == -1) - return -1; - continue; - } - - /* Discard t...

...t;validating export name"; if (check_export_name (conn, option, &data[4], exportnamelen, - optlen - 8, false) == -1) + optlen - 8, + option == NBD_OPT_SET_META_CONTEXT) == -1) goto opt_meta_invalid_option_len; opt_index = 4 + exportnamelen; -- 2.21.0

...ortnamelen); what = "checking export name"; @@ -561,6 +572,15 @@ negotiate_handshake_newstyle_options (struct connection *conn) what = "export name must not contain NUL bytes"; if (strnlen (&data[4], exportnamelen) != exportnamelen) goto opt_meta_invalid_option_len; + if (option == NBD_OPT_SET_META_CONTEXT) { + free (conn->exportname); + conn->exportname = strndup (&data[4], exportnamelen); + if (conn->exportname == NULL) { + nbdkit_error ("strndup: %m"); + return -1; + }...

These are a couple of patches in preparation for the Block Status implementation. While the patches (especially the second one) are very large they are really just elementary code motion. Rich.

The first one is the nastiest - it is an assertion failure caused by a spec-compliant client and introduced by our security fix that was released in 1.14.1. Eric Blake (4): server: Fix regression for NBD_OPT_INFO before NBD_OPT_GO server: Fix back-to-back SET_META_CONTEXT server: Forbid NUL in export and context names server: Fix OPT_GO on different export than SET_META_CONTEXT

Since the v1 series (0/4, at [1]), I've applied patches 1 and 2, rewritten patch 3 [Forbid NUL in export and context names] into patch 4 here, patch 4 there turned into patch 6 here, and everything else here is new. [1]https://www.redhat.com/archives/libguestfs/2019-September/msg00180.html I don't know if there is a handy reusable function for checking whether a string contains valid

...} + memcpy (&exportnamelen, &data[0], 4); + exportnamelen = be32toh (exportnamelen); + what = "validating export name"; + if (check_export_name (option, &data[4], exportnamelen, + optlen - 8) == -1) + goto opt_meta_invalid_option_len; + /* Remember the export name: the NBD spec says that if the client * later uses NBD_OPT_GO on a different export, then the context * returned here is not usable. */ - memcpy (&exportnamelen, &data[0], 4); - exportnamelen = be32toh (expo...

...g export name"; - if (check_export_name (conn, option, &data[4], exportnamelen, + if (check_export_name (option, &data[4], exportnamelen, optlen - 8, option == NBD_OPT_SET_META_CONTEXT) == -1) goto opt_meta_invalid_option_len; @@ -630,13 +626,14 @@ negotiate_handshake_newstyle_options (struct connection *conn) conn->meta_context_base_allocation = false; if (nr_queries == 0) { if (option == NBD_OPT_LIST_META_CONTEXT) { - if (send_newstyle_option_reply_meta_context -...

v1 was here: https://www.redhat.com/archives/libguestfs/2020-February/msg00081.html v2 replaces struct connection *conn = GET_CONN; with GET_CONN; which sets conn implicitly and asserts that it is non-NULL. If we actually want to test if conn is non-NULL or behave differently, then you must use threadlocal_get_conn() instead, and some existing uses do that. Rich.

The third patch is a large but mechanical change which gets rid of passing around struct connection * entirely within the server, preferring instead to reference the connection through thread-local storage. I hope this is a gateway to simplifying other parts of the code. Rich.