From ed2f11bbe3ead86611afbef011d9c6ac72c376ff Mon Sep 17 00:00:00 2001 From: Aleksander Morgado Date: Wed, 21 Jun 2017 21:13:13 +0200 Subject: ratp: fix data presence check Looking at the "data length" and SO flag isn't enough to declare a packet with or without data, because SYN flagged packets will also use the "data length" field to define MDL. So, improve the check to match against SYN|RST|FIN flagged packets, which can never have data. This commit fixed a segfault in barebox when an unexpected SYN packet was sent in the middle of a connection; barebox thought the packet had data because the "data length" in the SYN packet was different than 0. Signed-off-by: Aleksander Morgado Signed-off-by: Sascha Hauer --- lib/ratp.c | 4 ++-- scripts/remote/ratp.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/ratp.c b/lib/ratp.c index d3c252047a..c946bea1a5 100644 --- a/lib/ratp.c +++ b/lib/ratp.c @@ -165,7 +165,7 @@ static bool ratp_has_data(struct ratp_header *hdr) { if (hdr->control & RATP_CONTROL_SO) return 1; - if (hdr->data_length) + if (!(hdr->control & (RATP_CONTROL_SYN | RATP_CONTROL_RST | RATP_CONTROL_FIN)) && hdr->data_length) return 1; return 0; } @@ -1338,7 +1338,7 @@ static int ratp_behaviour_i1(struct ratp_internal *ri, void *pkt) struct ratp_header *hdr = pkt; uint8_t control = 0; - if (!hdr->data_length && !(hdr->control & RATP_CONTROL_SO)) + if (!ratp_has_data (hdr)) return 1; pr_vdebug("%s **received** %d\n", __func__, hdr->data_length); diff --git a/scripts/remote/ratp.py b/scripts/remote/ratp.py index 079fb871a3..a41d2e8a3f 100644 --- a/scripts/remote/ratp.py +++ b/scripts/remote/ratp.py @@ -525,7 +525,7 @@ class RatpConnection(object): # Our fin was lost, rely on retransmission return False - if r.length or r.c_so: + if (r.length and not r.c_syn and not r.c_rst and not r.c_fin) or r.c_so: self._retrans = None s = RatpPacket(flags='RA') s.c_sn = r.c_an @@ -596,7 +596,7 @@ class RatpConnection(object): if r.c_so: self._r_sn = r.c_sn self._rx_buf.append(chr(r.length)) - elif r.length: + elif r.length and not r.c_syn and not r.c_rst and not r.c_fin: self._r_sn = r.c_sn self._rx_buf.append(r.payload) else: -- cgit v1.2.3