[Bug 298085] hastd/hastctl abort on a legitimate zero-size protocol message (hast_proto_recv_hdr asserts non-NULL on an empty ebuf)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298085

--- Comment #6 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=8646d65b45339642d4aab1de35a2bc79fc45f09e

commit 8646d65b45339642d4aab1de35a2bc79fc45f09e
Author:     Glen Barber <gjb@FreeBSD.org>
AuthorDate: 2026-09-03 07:51:28 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2026-09-03 07:58:54 +0000

    hastd: Fix crash on empty message

    A HAST message can be empty, in which case ebuf_add_tail() does nothing
    and ebuf_data() returns NULL because the size of the ebuf is zero, but
    hast_proto_recv_hdr() asserts that the return value is not NULL,
    resulting in an immediate crash if hastctl or hastd receive an empty
    message.  This is trivially reproducable by running `hastctl status` or
    `hastctl role init` (as the rc script does prior to stopping hastd).

    To avoid this, don't try to grow the ebuf or receive additional data
    if the header size is zero.

    PR:             298085
    MFC after:      3 days
    Reviewed by:    kevans, gjb
    Differential Revision:  https://reviews.freebsd.org/D59306

 sbin/hastd/hast_proto.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

-- 
You are receiving this mail because:
You are the assignee for the bug.