Skip to content
This repository has been archived by the owner on Oct 23, 2021. It is now read-only.

Commit

Permalink
Fix invalid reading from the request
Browse files Browse the repository at this point in the history
There is a list only in the init request, otherwise memory junk can be read
when req->index == req->len
  • Loading branch information
hegedenes committed Mar 20, 2018
1 parent a6db9a0 commit ed57bd9
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions c_src/gen_driver.c
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,9 @@ async(void *data) {
}

/* Dispatch unless an error or initialization occurred */
if (!strlen(ptr->res->error) && ptr->req->cmd != GD_CMD_INIT)
if (ptr->req->cmd == GD_CMD_INIT) {
ei_decode_list_header(ptr->req->buf, &ptr->req->index, NULL);
} else if (!strlen(ptr->res->error))
dispatch(ptr->req, ptr->res, ptr->drv_state, trd_state);
}

Expand Down Expand Up @@ -178,7 +180,6 @@ ready(ErlDrvData drv_data, ErlDrvThreadData thread_data) {
gd_ptr_t *ptr = (void *)thread_data;

/* Check, if we reached the end of the request buffer */
ei_decode_list_header(ptr->req->buf, &ptr->req->index, NULL);
if (!error_occurred(ptr->res) && ptr->req->len != ptr->req->index)
error_set(ptr->res, GD_ERR_DECODE);

Expand Down

0 comments on commit ed57bd9

Please sign in to comment.