Apple-2-Tools/DiskBrowser
1
0
Fork 0
mirror of https://github.com/sheumann/DiskBrowser.git synced 2024-11-21 22:31:13 +00:00
Code Issues Projects Releases Wiki Activity

Work around Marinetti bug 57.

Browse Source 
This could cause Marinetti to return more data than it should, starting with valid data but then including corrupt data.

The workaround I'm using is to have Marinetti return a new handle and then copy the data out of it, using the size of the handle as the true size of the data that was read. Because of details of how Marinetti works, that size is correct.
This commit is contained in:
Stephen Heumann 2019-04-15 19:50:36 -05:00
parent 5d59a9d032
commit 37b26592d0
2 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
diskbrowser.c
View File

@ -312,6 +312,11 @@ void DoSearch(void) {
/* keep reading */ ; /* keep reading */ ;
sess.contentLength -= sess.readCount; sess.contentLength -= sess.readCount;
*(netBuf + sess.contentLength) = 0; *(netBuf + sess.contentLength) = 0;
if (sess.contentLength == 0) {
result = NO_RESPONSE;
goto errorReturn;
}
if (json) if (json)
json_value_free(json); json_value_free(json);

18
readtcp.c
View File

@ -2,7 +2,9 @@
#include "readtcp.h" #include "readtcp.h"
#include "session.h" #include "session.h"
#include <string.h>
#include <tcpip.h> #include <tcpip.h>
#include <memory.h>
#include <misctool.h> #include <misctool.h>
#include <orca.h> #include <orca.h>
@ -24,15 +26,25 @@ ReadStatus TryReadTCP(Session *sess) {
rrBuff rrBuff; rrBuff rrBuff;
TCPIPPoll(); TCPIPPoll();
sess->tcperr = TCPIPReadTCP(sess->ipid, buffTypePointer, (Ref)sess->readPtr, sess->tcperr = TCPIPReadTCP(sess->ipid, buffTypeNewHandle, NULL,
sess->readCount, &rrBuff); sess->readCount, &rrBuff);
sess->toolerr = toolerror(); sess->toolerr = toolerror();
if (sess->tcperr || sess->toolerr) { if (sess->tcperr || sess->toolerr) {
return rsError; return rsError;
} }
sess->readCount -= rrBuff.rrBuffCount; if (rrBuff.rrBuffCount != 0) {
sess->readPtr += rrBuff.rrBuffCount; /* Work around Marinetti bug #57 */
rrBuff.rrBuffCount = GetHandleSize(rrBuff.rrBuffHandle);
HLock(rrBuff.rrBuffHandle);
memcpy(sess->readPtr, *rrBuff.rrBuffHandle, rrBuff.rrBuffCount);
DisposeHandle(rrBuff.rrBuffHandle);
sess->readCount -= rrBuff.rrBuffCount;
sess->readPtr += rrBuff.rrBuffCount;
}
if (sess->readCount == 0) { if (sess->readCount == 0) {
return rsDone; return rsDone;