LwIP: clamp reads to a value that can be expressed in 16 bits

There is a bug in the LwIP VFS plugin, the chained buffers used by Lwip
use sizes expressed in sixteen bits, and under conditions such as a read
of 1<<16 the higher bits are lost and the plugin performs a zero length
read, and the application interprets this as a closed connection.

Fix #2947
This commit is contained in:
Ehmry - 2018-08-28 13:55:35 +02:00 committed by Christian Helmuth
parent 0bcab1df84
commit 6f8e8a6ea4
1 changed files with 6 additions and 0 deletions

View File

@ -1775,6 +1775,12 @@ class Lwip::File_system final : public Vfs::File_system
char *dst, file_size count,
file_size &out_count) override
{
/*
* LwIP buffer operations are limited to sizes that
* can be expressed in sixteen bits
*/
count = Genode::min(count, 0xffffU);
out_count = 0;
if ((!vfs_handle) ||