On Tue, 2018-02-27 at 12:03 -0500, Frediano Ziglio wrote:
> >
> > Signed-off-by: Lukáš Hrázký <lhrazky@xxxxxxxxxx>
> > ---
> > src/spice-streaming-agent.cpp | 28 +++++++++++++++++++++++++---
> > 1 file changed, 25 insertions(+), 3 deletions(-)
> >
> > diff --git a/src/spice-streaming-agent.cpp b/src/spice-streaming-agent.cpp
> > index ee57920..53dbca0 100644
> > --- a/src/spice-streaming-agent.cpp
> > +++ b/src/spice-streaming-agent.cpp
> > @@ -137,10 +137,32 @@ static void handle_stream_capabilities(uint32_t len)
> > }
> > }
> >
> > -static void handle_stream_error(uint32_t len)
> > +struct StreamMsgNotifyError1K : StreamMsgNotifyError {
> > + uint8_t msg[1024];
> > +};
> > +
> > +static void handle_stream_error(size_t len)
> > {
> > - // TODO read message and use it
> > - throw std::runtime_error("got an error message from server");
> > + if (len < sizeof(StreamMsgNotifyError)) {
> > + throw std::runtime_error("Received NotifyError message size " +
> > std::to_string(len) +
> > + " is too small (smaller than " +
> > +
> > std::to_string(sizeof(StreamMsgNotifyError))
> > + ")");
> > + }
> > +
> > + StreamMsgNotifyError1K msg;
>
> I would have inlined the definition of the structure using
> an unnamed structure but just question of style, fine for me.
I actually didn't know that's possible :) cool.
> > +
> > + size_t len_to_read = std::min(len, sizeof(msg));
>
> buffer overflow, should be std::min(len, sizeof(msg)-1) to allow space for
> terminator.
Right. I was kind of thinking the server probably sends the \0. Where
is this documented, actually?
> > +
> > + read_all(&msg, len_to_read);
> > + msg.msg[len_to_read - sizeof(StreamMsgNotifyError)] = '\0';
> > +
> > + syslog(LOG_ERR, "Received NotifyError message from the server: %d -
> > %s\n",
> > + msg.error_code, msg.msg);
>
> Note that syslog don't need line termination (\n).
Really? It's everywhere throughout the streaming agent.
> > +
> > + if (len_to_read > len) {
>
> here should be if (len_to_read < len)
Oops!
> > + throw std::runtime_error("Received NotifyError message size " +
> > std::to_string(len) +
> > + " is too big (bigger than " +
> > std::to_string(sizeof(msg)) + ")");
> > + }
> > }
> >
> > static void read_command_from_device(void)
>
> Frediano
_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/spice-devel