Fix data corruption bug

[netatalk.git] / libatalk / dsi / dsi_stream.c

diff --git a/libatalk/dsi/dsi_stream.c b/libatalk/dsi/dsi_stream.c
index 37d4c121471245a32941efc506a401079502ee6c..711a037b5098925c59c77198bb6350d390d9b5a3 100644 (file)
--- a/libatalk/dsi/dsi_stream.c
+++ b/libatalk/dsi/dsi_stream.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 1998 Adrian Sun (asun@zoology.washington.edu)
+ * Copyright (c) 2010,2011,2012 Frank Lahm <franklahm@googlemail.com>
  * All rights reserved. See COPYRIGHT.
  *
  * this file provides the following functions:
@@ -30,8 +31,6 @@
 #include <atalk/dsi.h>
 #include <atalk/util.h>
 
-#define min(a,b)  ((a) < (b) ? (a) : (b))
-
 #ifndef MSG_MORE
 #define MSG_MORE 0x8000
 #endif
@@ -40,6 +39,17 @@
 #define MSG_DONTWAIT 0x40
 #endif
 
+/* Pack a DSI header in wire format */
+static void dsi_header_pack_reply(const DSI *dsi, char *buf)
+{
+    buf[0] = dsi->header.dsi_flags;
+    buf[1] = dsi->header.dsi_command;
+    memcpy(buf + 2, &dsi->header.dsi_requestID, sizeof(dsi->header.dsi_requestID));           
+    memcpy(buf + 4, &dsi->header.dsi_code, sizeof(dsi->header.dsi_code));
+    memcpy(buf + 8, &dsi->header.dsi_len, sizeof(dsi->header.dsi_len));
+    memcpy(buf + 12, &dsi->header.dsi_reserved, sizeof(dsi->header.dsi_reserved));
+}
+
 /*
  * afpd is sleeping too much while trying to send something.
  * May be there's no reader or the reader is also sleeping in write,
@@ -140,7 +150,7 @@ static size_t from_buf(DSI *dsi, uint8_t *buf, size_t count)
     nbe = dsi->eof - dsi->start;
 
     if (nbe > 0) {
-        nbe = min((size_t)nbe, count);
+        nbe = MIN((size_t)nbe, count);
         memcpy(buf, dsi->start, nbe);
         dsi->start += nbe;
 
@@ -200,7 +210,7 @@ static size_t dsi_buffered_stream_read(DSI *dsi, uint8_t *data, const size_t len
   }
 
   /* fill the buffer with 8192 bytes or until buffer is full */
-  buflen = min(8192, dsi->end - dsi->eof);
+  buflen = MIN(8192, dsi->end - dsi->eof);
   if (buflen > 0) {
       ssize_t ret;
       ret = read(dsi->socket, dsi->eof, buflen);
@@ -319,18 +329,6 @@ exit:
   return written;
 }
 
-/* Pack a DSI header in wire format */
-static void dsi_header_pack_reply(const DSI *dsi, char *buf)
-{
-    buf[0] = dsi->header.dsi_flags;
-    buf[1] = dsi->header.dsi_command;
-    memcpy(buf + 2, &dsi->header.dsi_requestID, sizeof(dsi->header.dsi_requestID));           
-    memcpy(buf + 4, &dsi->header.dsi_code, sizeof(dsi->header.dsi_code));
-    memcpy(buf + 8, &dsi->header.dsi_len, sizeof(dsi->header.dsi_len));
-    memcpy(buf + 12, &dsi->header.dsi_reserved, sizeof(dsi->header.dsi_reserved));
-}
-
-
 /* ---------------------------------
 */
 #ifdef WITH_SENDFILE
@@ -366,7 +364,9 @@ ssize_t dsi_stream_read_file(DSI *dsi, const int fromfd, off_t offset, const siz
     sfvcnt = 2;
     vec[0].sfv_fd = SFV_FD_SELF;
     vec[0].sfv_flag = 0;
-    vec[0].sfv_off = block;
+    /* Cast to unsigned long to prevent sign extension of the
+     * pointer value for the LFS case; see Apache PR 39463. */
+    vec[0].sfv_off = (unsigned long)block;
     vec[0].sfv_len = DSI_BLOCKSIZ;
     vec[1].sfv_fd = fromfd;
     vec[1].sfv_flag = 0;
@@ -387,19 +387,20 @@ ssize_t dsi_stream_read_file(DSI *dsi, const int fromfd, off_t offset, const siz
             switch (errno) {
             case EINTR:
             case EAGAIN:
-#if defined(SOLARIS) || defined(FREEBSD)
+                len = 0;
 #ifdef HAVE_SENDFILEV
                 len = (size_t)nwritten;
 #else
+#if defined(SOLARIS) || defined(FREEBSD)
                 if (pos > offset) {
                     /* we actually have sent sth., adjust counters and keep trying */
                     len = pos - offset;
-                    written += len;
                     offset = pos;
                 }
-#endif /* HAVE_SENDFILEV */
 #endif /* defined(SOLARIS) || defined(FREEBSD) */
-                if (dsi_peek(dsi)) {
+#endif /* HAVE_SENDFILEV */
+
+                if (dsi_peek(dsi) != 0) {
                     ret = -1;
                     goto exit;
                 }
@@ -426,7 +427,7 @@ ssize_t dsi_stream_read_file(DSI *dsi, const int fromfd, off_t offset, const siz
             vec[0].sfv_len -= len;
         }
 #endif  /* HAVE_SENDFILEV */
-
+        LOG(log_maxdebug, logtype_dsi, "dsi_stream_read_file: wrote: %zd", len);
         written += len;
     }
 #ifdef HAVE_SENDFILEV
@@ -507,14 +508,7 @@ int dsi_stream_send(DSI *dsi, void *buf, size_t length)
   if (dsi->flags & DSI_DISCONNECTED)
       return 0;
 
-  block[0] = dsi->header.dsi_flags;
-  block[1] = dsi->header.dsi_command;
-  memcpy(block + 2, &dsi->header.dsi_requestID, 
-        sizeof(dsi->header.dsi_requestID));
-  memcpy(block + 4, &dsi->header.dsi_code, sizeof(dsi->header.dsi_code));
-  memcpy(block + 8, &dsi->header.dsi_len, sizeof(dsi->header.dsi_len));
-  memcpy(block + 12, &dsi->header.dsi_reserved,
-        sizeof(dsi->header.dsi_reserved));
+  dsi_header_pack_reply(dsi, block);
 
   if (!length) { /* just write the header */
       LOG(log_maxdebug, logtype_dsi, "dsi_stream_send(%u bytes): DSI header, no data", sizeof(block));
@@ -539,7 +533,7 @@ int dsi_stream_send(DSI *dsi, void *buf, size_t length)
           break;
       else if (len < 0) { /* error */
           if (errno == EAGAIN || errno == EWOULDBLOCK) {
-              if (!dsi_peek(dsi)) {
+              if (dsi_peek(dsi) == 0) {
                   continue;
               }
           }
@@ -602,7 +596,7 @@ int dsi_stream_receive(DSI *dsi)
   dsi->clientID = ntohs(dsi->header.dsi_requestID);
   
   /* make sure we don't over-write our buffers. */
-  dsi->cmdlen = min(ntohl(dsi->header.dsi_len), DSI_CMDSIZ);
+  dsi->cmdlen = MIN(ntohl(dsi->header.dsi_len), dsi->server_quantum);
   if (dsi_stream_read(dsi, dsi->commands, dsi->cmdlen) != dsi->cmdlen) 
     return 0;