[Spread-cvs] cvs commit: spread/daemon Readme.txt sp.c

[jonathan at spread.org]

jonathan    04/09/23 14:07:35

  Modified:    daemon   Readme.txt sp.c
  Log:
  Fix bug in libspread reported by John Schultz. This bug occured when a client
  called SP_recv* with either a too-short groups array or message buffer. In that
  case the mess_type field was truncated when returned. The truncation has been
  fixed, and the sender field is also now returned.
  
  Revision  Changes    Path
  1.57      +5 -0      spread/daemon/Readme.txt
  
  Index: Readme.txt
  ===================================================================
  RCS file: /storage/cvsroot/spread/daemon/Readme.txt,v
  retrieving revision 1.56
  retrieving revision 1.57
  diff -u -r1.56 -r1.57
  --- Readme.txt	23 Sep 2004 17:27:39 -0000	1.56
  +++ Readme.txt	23 Sep 2004 18:07:34 -0000	1.57
  @@ -63,6 +63,11 @@
      on windows will use multiple threads to send/recv updates and get
      user imput. (A POSIX thread option is also added).
   5) Fix a bug in the Windows build using VC++ of thread-safe libtspread.lib.
  +   Bug and fix by Jacob Green.
  +6) Fix bug in libspread where if the groups array or message body passed
  +   to SP_recv* was too small, the mess_type field returned would be truncated
  +   and the sender field was not returned. They are both now returned correctly.
  +   Bug report and partial fix provided by John Schultz. 
   
   SOURCE INSTALL:
   ---------------
  
  
  
  1.12      +23 -8     spread/daemon/sp.c
  
  Index: sp.c
  ===================================================================
  RCS file: /storage/cvsroot/spread/daemon/sp.c,v
  retrieving revision 1.11
  retrieving revision 1.12
  diff -u -r1.11 -r1.12
  --- sp.c	5 Mar 2004 00:32:46 -0000	1.11
  +++ sp.c	23 Sep 2004 18:07:34 -0000	1.12
  @@ -1107,7 +1107,7 @@
   	message_header	mess_head;
   	message_header	*head_ptr;
   	char		*buf_ptr;
  -        int16           temp_mess_type;
  +        int32           temp_mess_type;
   	int		len, remain, ret;
   	int		max_mess_len;
   	int		short_buffer;
  @@ -1232,12 +1232,26 @@
                                   Sessions[ses].recv_message_saved = 1;
                                   Mutex_unlock( &Struct_mutex );
                           }
  +                        /* When *_TOO_SHORT error will be returned, provide caller with all available information:
  +                         * service_type
  +                         * sender
  +                         * mess_type
  +                         * 
  +                         * The num_groups field and endian_mismatch field are used to specify the required
  +                         * size of the groups array and message body array in order to fit the current message
  +                         * so, they do NOT have their usual meaning. 
  +                         * If number of groups in the message is > max_groups then the number of required groups 
  +                         *   is returned as a negative value in the num_groups field.
  +                         * If the size of the message is > max_mess_len, then the required size in bytes is 
  +                         *   returned as a negative value in the endian_mismatch field.
  +                         */
                           if ( Is_regular_mess( head_ptr->type ) || Is_reject_mess( head_ptr->type ) )
                           {
                                   temp_mess_type = head_ptr->hint;
                                   if ( !Same_endian( head_ptr->hint ) ) {
                                           temp_mess_type = Flip_int32( temp_mess_type );
                                   }
  +                                temp_mess_type = Clear_endian( temp_mess_type );
                                   *mess_type = ( temp_mess_type >> 8 ) & 0x0000ffff;
                           }
                           else 
  @@ -1251,6 +1265,10 @@
                                   *endian_mismatch = -(head_ptr->data_len);
                           else
                                   *endian_mismatch = 0;
  +
  +                        /* Return sender field to caller */
  +                        strncpy( sender, head_ptr->private_group_name, MAX_GROUP_NAME );
  +
                           Mutex_unlock( &Mbox_mutex[mbox & MAX_MUTEX_MASK][1] );
                           if (*num_groups)
                                   return( GROUPS_TOO_SHORT );
  @@ -1264,22 +1282,19 @@
   		if( !Same_endian( head_ptr->hint ) )
   		{
   			head_ptr->hint = Flip_int32( head_ptr->hint );
  -			head_ptr->hint = Clear_endian( head_ptr->hint );
  -			head_ptr->hint = ( head_ptr->hint >> 8 ) & 0x0000ffff;
  -			*mess_type = head_ptr->hint;
   			*endian_mismatch = 1;
   		}else{
  -			head_ptr->hint = Clear_endian( head_ptr->hint );
  -			head_ptr->hint = ( head_ptr->hint >> 8 ) & 0x0000ffff;
  -			*mess_type = head_ptr->hint;
   			*endian_mismatch = 0;
   		}
  +                head_ptr->hint = Clear_endian( head_ptr->hint );
  +                head_ptr->hint = ( head_ptr->hint >> 8 ) & 0x0000ffff;
  +                *mess_type = head_ptr->hint;
   	}else{
   		*mess_type = -1; /* marks the index (0..n-1) of the member in the group */
   		*endian_mismatch = 0;
   	}
   
  -	strcpy( sender, head_ptr->private_group_name );
  +	strncpy( sender, head_ptr->private_group_name, MAX_GROUP_NAME );
           
           /* if a reject message read the extra old_type field first, and merge with head_ptr->type */
           if ( Is_reject_mess( head_ptr->type ) )