[Freeciv-Dev] (PR#12692) Make packet handling more robust

["Raimar Falke" <i-freeciv-lists@xxxxxxxxxxxxx>]

<URL: http://bugs.freeciv.org/Ticket/Display.html?id=12692 >


It fixes two issues which recently showed up.

        Raimar

-- 
 email: i-freeciv-lists@xxxxxxxxxxxxx
  Microsoft does have a year 2000 problem. I'm part of it. I'm running Linux.

Index: client/clinet.c
===================================================================
RCS file: /home/freeciv/CVS/freeciv/client/clinet.c,v
retrieving revision 1.113
diff -u -u -r1.113 clinet.c
--- client/clinet.c     22 Feb 2005 00:53:07 -0000      1.113
+++ client/clinet.c     29 Mar 2005 17:23:03 -0000
@@ -185,6 +185,8 @@
 {
   struct packet_server_join_req req;
 
+  close_socket_set_callback(close_socket_callback);
+
   /* connection in progress? wait. */
   if (aconnection.used) {
     (void) mystrlcpy(errbuf, _("Connection in progress."), errbufsize);
Index: common/connection.c
===================================================================
RCS file: /home/freeciv/CVS/freeciv/common/connection.c,v
retrieving revision 1.46
diff -u -u -r1.46 connection.c
--- common/connection.c 22 Jan 2005 19:45:41 -0000      1.46
+++ common/connection.c 29 Mar 2005 17:23:03 -0000
@@ -118,6 +118,14 @@
 }
 
 /**************************************************************************
+  Return the the close_callback.
+**************************************************************************/
+CLOSE_FUN close_socket_get_callback(void)
+{
+  return close_callback;
+}
+
+/**************************************************************************
 ...
 **************************************************************************/
 static bool buffer_ensure_free_extra_space(struct socket_packet_buffer *buf,
Index: common/connection.h
===================================================================
RCS file: /home/freeciv/CVS/freeciv/common/connection.h,v
retrieving revision 1.40
diff -u -u -r1.40 connection.h
--- common/connection.h 22 Jan 2005 19:45:41 -0000      1.40
+++ common/connection.h 29 Mar 2005 17:23:03 -0000
@@ -241,6 +241,7 @@
 
 typedef void (*CLOSE_FUN) (struct connection *pc);
 void close_socket_set_callback(CLOSE_FUN fun);
+CLOSE_FUN close_socket_get_callback(void);
 
 int read_socket_data(int sock, struct socket_packet_buffer *buffer);
 void flush_connection_send_buffer_all(struct connection *pc);
Index: common/packets.c
===================================================================
RCS file: /home/freeciv/CVS/freeciv/common/packets.c,v
retrieving revision 1.273
diff -u -u -r1.273 packets.c
--- common/packets.c    28 Jan 2005 19:57:09 -0000      1.273
+++ common/packets.c    29 Mar 2005 17:23:04 -0000
@@ -381,7 +381,16 @@
        uncompress(decompressed, &decompressed_size,
                   ADD_TO_POINTER(buffer->data, header_size), 
                   compressed_size);
-    assert(error == Z_OK);
+    if (error != Z_OK) {
+      CLOSE_FUN close_callback = close_socket_get_callback();
+
+      freelog(LOG_ERROR, "Uncompressing of the packet stream failed. "
+             "The connection will be closed now.");
+      assert(close_callback);
+      (*close_callback) (pc);
+
+      return NULL;
+    }
 
     buffer->ndata -= whole_packet_len;
     /* 
@@ -417,6 +426,21 @@
   }
 #endif
 
+  /*
+   * At this point the packet is a plain uncompressed one. These have
+   * to have to be at least 3 bytes in size.
+   */
+  if (whole_packet_len < 3) {
+    CLOSE_FUN close_callback = close_socket_get_callback();
+
+    freelog(LOG_ERROR, "The packet stream is corrupt. The connection "
+           "will be closed now.");
+    assert(close_callback);
+    (*close_callback) (pc);
+
+    return NULL;
+  }
+
   dio_get_uint8(&din, &utype.itype);
 
   freelog(BASIC_PACKET_LOG_LEVEL, "got packet type=(%s)%d len=%d",