-
Notifications
You must be signed in to change notification settings - Fork 26
Open
Description
There is a potential bug in the Stream implementation of the litep2p Substream object.
The poll_next implementation can terminate the substream incorrectly / abruptly.
This can happen on fragmented reads using the ProtocolCodec::Identify protocol:
- Presume we want to read 1024 from the network
- The OS delivered the TCP reads in two chunks of 512 bytes
Line 539 in b16c74c
match futures::ready!(poll_read!(&mut this.substream, cx, &mut read_buf)) { - The first read sets the
nreadto 512 - The second read sets the
nreadto 512 - At this point, we are comparing
512with1024, which is wrong, because we have drained from the OS socket 1024 bytes in total:
Line 551 in b16c74c
| if nread == payload_size { |
At the next point, the socket may return 0, and we'll terminate the connection immediately.
Discovered during:
Metadata
Metadata
Assignees
Labels
No labels