Commit 09574a61 authored by Perry Kundert's avatar Perry Kundert Committed by Martin Sustrik

Corrected discarding of remainder of message when request ID invalid

When zmq::req_t::xrecv detects that a response has no request ID
label, or the ID is the wrong size, it would return an EAGAIN, but
would not discard the remainder of the message.  This could allow the
remainder of the message to incorrectly "leak" into a future response,
if it is crafted to look like a reply with a valid response ID.
Discard all remaining message blocks, if the ID is invalid in any way.
parent 52bab422
......@@ -92,14 +92,20 @@ int zmq::req_t::xrecv (msg_t *msg_, int flags_)
// TODO: This should also close the connection with the peer!
if (unlikely (!(msg_->flags () & msg_t::label) || msg_->size () != 4)) {
while (true) {
int rc = xreq_t::xrecv (msg_, flags_);
errno_assert (rc == 0);
if (!(msg_->flags () & (msg_t::label | msg_t::more)))
break;
}
msg_->close ();
msg_->init ();
errno = EAGAIN;
return -1;
}
unsigned char *data = (unsigned char*) msg_->data ();
if (unlikely (get_uint32 (data) != request_id)) {
// The request ID does not match. Drop the entire message.
while (true) {
int rc = xreq_t::xrecv (msg_, flags_);
errno_assert (rc == 0);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment