diff options
author | Jon Simons <jon@jonsimons.org> | 2014-01-30 18:30:41 -0800 |
---|---|---|
committer | Andreas Schneider <asn@cryptomilk.org> | 2014-02-02 22:19:46 +0100 |
commit | 95782ada1f4bed83472bc3bc7e464d07a49fb3ae (patch) | |
tree | 3f22e9e5105baf309e8905f92c891b50b2cdd417 /ConfigureChecks.cmake | |
parent | f7b61bf5572531664146c12a10a419d4176c4a6c (diff) | |
download | libssh-95782ada1f4bed83472bc3bc7e464d07a49fb3ae.tar.gz libssh-95782ada1f4bed83472bc3bc7e464d07a49fb3ae.tar.xz libssh-95782ada1f4bed83472bc3bc7e464d07a49fb3ae.zip |
socket: fix read of non-connected socket
Ensure to check whether the socket at hand is indeed still connected
throughout POLLIN processing in ssh_socket_pollcallback.
Before this change, the POLLIN block in ssh_socket_pollcallback is
predicated against the condition (s->state == SSH_SOCKET_CONNECTED).
Once entered, data from the socket is consumed through the data
callback in this loop:
do {
r = s->callbacks->data(buffer_get_rest(s->in_buffer),
buffer_get_rest_len(s->in_buffer),
s->callbacks->userdata);
buffer_pass_bytes(s->in_buffer,r);
} while (r > 0);
However, it is possible for the socket data callback to change the
state of the socket (closing it, for example). Fix the loop to only
continue so long as the socket remains connected: this also entails
setting the ssh_socket state to SSH_SOCKET_CLOSED upon close.
The bug can be observed before the change by sending a bogus banner
to the server: 'echo -e "A\r\nB\r\n" | nc localhost 22'. Each of
'A' and 'B' will be processed by 'callback_receive_banner', even
though the client socket is closed after rejection of 'A'.
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
Diffstat (limited to 'ConfigureChecks.cmake')
0 files changed, 0 insertions, 0 deletions