diff options
| author | Troy Lee <troy_lee@aspeedtech.com> | 2021-08-02 06:08:26 +0300 |
|---|---|---|
| committer | Ed Tanous <ed@tanous.net> | 2022-05-24 17:22:28 +0300 |
| commit | 4ee8f0b7c758125b938ff7530f4ef460c3703b62 (patch) | |
| tree | 5e626562eb6897b8a8a3ac240af209d37bff4ef4 | |
| parent | 0fd2986567e6e5328942e126b2c7ed28ab12de83 (diff) | |
| download | bmcweb-4ee8f0b7c758125b938ff7530f4ef460c3703b62.tar.xz | |
bmcweb: fixes virtual media buffer overflow
The bmcweb is implementated as async i/o access, sometimes the input
buffer still has unprocessed data, and the next websocket message comes
in. The input buffer originally reserved only 1 nbd request packet size,
so it will cause buffer overflow exception. Extend the buffer size and
correctly check the remaining buffer size.
v8: fix coding style
v7: remove debug log and proxy.wait() change to keep this change simple
v4: fix coding style
v3: fix coding style
v2: fix coding style
Signed-off-by: Troy Lee <troy_lee@aspeedtech.com>
Change-Id: I8df2445503393f63401678d9f2486a80d31aee16
| -rw-r--r-- | include/vm_websocket.hpp | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/include/vm_websocket.hpp b/include/vm_websocket.hpp index 6c97f85b13..2dbdaf6966 100644 --- a/include/vm_websocket.hpp +++ b/include/vm_websocket.hpp @@ -19,7 +19,7 @@ static crow::websocket::Connection* session = nullptr; // The max network block device buffer size is 128kb plus 16bytes // for the message header: // https://github.com/NetworkBlockDevice/nbd/blob/master/doc/proto.md#simple-reply-message -static constexpr auto nbdBufferSize = 131088; +static constexpr auto nbdBufferSize = (128 * 1024 + 16) * 4; class Handler : public std::enable_shared_from_this<Handler> { @@ -203,7 +203,8 @@ inline void requestRoutes(App& app) }) .onmessage([](crow::websocket::Connection& conn, const std::string& data, bool) { - if (data.length() > handler->inputBuffer->capacity()) + if (data.length() > + handler->inputBuffer->capacity() - handler->inputBuffer->size()) { BMCWEB_LOG_ERROR << "Buffer overrun when writing " << data.length() << " bytes"; |