Skip to content

4KiB hard-coded buffer limits #51

Description

@mxjeff

Here is a follow-up of debian bug report #953110 :


Reproducer:

Uses mpc to send a 'find' request, containing an invalid search expression. The expected result is an error message about the invalid search expression.

working:

$ strace -s 40 -e trace=sendto,recvfrom mpc find '('$(for i in $(seq 1 4086); do echo -n "+"; done)')'
 recvfrom(3, "OK MPD 0.21.4\n", 4096, MSG_DONTWAIT, NULL, NULL) = 14
 sendto(3, "find \"(+++++++++++++++++++++++++++++++++"..., 4096, MSG_DONTWAIT, NULL, 0) = 4096
 recvfrom(3, "ACK [2@0] {find} Word expected\n", 4096, MSG_DONTWAIT, NULL, NULL) = 31
 mpd error: Word expected
 +++ exited with 1 +++

Note the request size on line 3: 4096 bytes.

broken:

The only difference is one more '+' in the expression, which would result in a request of 4097 bytes.

 $ strace -s 40 -e trace=sendto,recvfrom mpc find '('$(for i in $(seq 1 4087); do echo -n "+"; done)')'
 recvfrom(3, "OK MPD 0.21.4\n", 4096, MSG_DONTWAIT, NULL, NULL) = 14
 mpd error: Timeout
 +++ exited with 1 +++

Instead of error about the invalid request, a timeout occurs after 30 seconds because the request is not really sent (note the missing sendto() call).

Ideally, libmpdclient should support requests of arbitrary size (eventually reaching the server limit), but if that is not feasible, at least a proper error reporting would be nice.


src: https://bugs.debian.org/953110

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions