git: 8646d65b4533 - main - hastd: Fix crash on empty message
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 03 Sep 2026 07:59:15 UTC
The branch main has been updated by des:
URL: https://cgit.FreeBSD.org/src/commit/?id=8646d65b45339642d4aab1de35a2bc79fc45f09e
commit 8646d65b45339642d4aab1de35a2bc79fc45f09e
Author: Glen Barber <gjb@FreeBSD.org>
AuthorDate: 2026-09-03 07:51:28 +0000
Commit: Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2026-09-03 07:58:54 +0000
hastd: Fix crash on empty message
A HAST message can be empty, in which case ebuf_add_tail() does nothing
and ebuf_data() returns NULL because the size of the ebuf is zero, but
hast_proto_recv_hdr() asserts that the return value is not NULL,
resulting in an immediate crash if hastctl or hastd receive an empty
message. This is trivially reproducable by running `hastctl status` or
`hastctl role init` (as the rc script does prior to stopping hastd).
To avoid this, don't try to grow the ebuf or receive additional data
if the header size is zero.
PR: 298085
MFC after: 3 days
Reviewed by: kevans, gjb
Differential Revision: https://reviews.freebsd.org/D59306
---
sbin/hastd/hast_proto.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/sbin/hastd/hast_proto.c b/sbin/hastd/hast_proto.c
index d9f231e7b007..fc90bf59dc8a 100644
--- a/sbin/hastd/hast_proto.c
+++ b/sbin/hastd/hast_proto.c
@@ -150,12 +150,14 @@ hast_proto_recv_hdr(const struct proto_conn *conn, struct nv **nvp)
eb = ebuf_alloc(hdr.size);
if (eb == NULL)
goto fail;
- if (ebuf_add_tail(eb, NULL, hdr.size) == -1)
- goto fail;
- hptr = ebuf_data(eb, NULL);
- PJDLOG_ASSERT(hptr != NULL);
- if (proto_recv(conn, hptr, hdr.size) == -1)
- goto fail;
+ if (hdr.size > 0) {
+ if (ebuf_add_tail(eb, NULL, hdr.size) == -1)
+ goto fail;
+ hptr = ebuf_data(eb, NULL);
+ PJDLOG_ASSERT(hptr != NULL);
+ if (proto_recv(conn, hptr, hdr.size) == -1)
+ goto fail;
+ }
nv = nv_ntoh(eb);
if (nv == NULL)
goto fail;