Command line printer manipulation client, and build goo.

[moira.git] / lib / mr_call.c

diff --git a/lib/mr_call.c b/lib/mr_call.c
index 9bd129835e1c3f17c8e4bf8a3b6ebf6de8b2a983..f226e68281cd7a798e3217d74aa17587270447c7 100644 (file)
--- a/lib/mr_call.c
+++ b/lib/mr_call.c
@@ -12,10 +12,15 @@
 #include "mr_private.h"
 
 #include <errno.h>
-#include <netinet/in.h>
 #include <stdlib.h>
 #include <string.h>
+#ifndef _WIN32
+#include <netinet/in.h>
+#endif /* _WIN32 */
+
+#ifdef HAVE_UNISTD_H
 #include <unistd.h>
+#endif
 
 RCSID("$Header$");
 
@@ -53,7 +58,8 @@ int mr_do_call(struct mr_params *params, struct mr_params *reply)
 
 int mr_send(int fd, struct mr_params *params)
 {
-  u_long length, written;
+  u_long length;
+  int written;
   int i, *argl;
   char *buf, *p;
 
@@ -99,12 +105,12 @@ int mr_send(int fd, struct mr_params *params)
   length = p - buf;
   putlong(buf, length);
 
-  written = write(fd, buf, length);
+  written = send(fd, buf, length, 0);
   free(buf);
   if (!params->mr_argl)
     free(argl);
 
-  if (written != length)
+  if (written != (int)length)
     return MR_ABORTED;
   else
     return MR_SUCCESS;
@@ -122,21 +128,29 @@ int mr_receive(int fd, struct mr_params *reply)
   return status;
 }
   
+/* Read some or all of a client response, without losing if it turns
+ * out to be malformed. Returns MR_SUCCESS on success, an error code
+ * on failure, or -1 if the packet hasn't been completely received
+ * yet.
+ */
+
 int mr_cont_receive(int fd, struct mr_params *reply)
 {
   u_long length, data;
-  ssize_t size, more;
-  char *p;
+  int size, more;
+  char *p, *end;
   int i;
 
   if (!reply->mr_flattened)
     {
       char lbuf[4];
 
-      size = read(fd, lbuf, 4);
+      size = recv(fd, lbuf, 4, 0);
       if (size != 4)
        return size ? MR_ABORTED : MR_NOT_CONNECTED;
       getlong(lbuf, length);
+      if (length > 8192)
+       return MR_INTERNAL;
       reply->mr_flattened = malloc(length);
       if (!reply->mr_flattened)
        return ENOMEM;
@@ -148,8 +162,8 @@ int mr_cont_receive(int fd, struct mr_params *reply)
   else
     getlong(reply->mr_flattened, length);
 
-  more = read(fd, reply->mr_flattened + reply->mr_filled,
-             length - reply->mr_filled);
+  more = recv(fd, reply->mr_flattened + reply->mr_filled,
+             length - reply->mr_filled, 0);
   if (more == -1)
     {
       mr_destroy_reply(*reply);
@@ -157,7 +171,7 @@ int mr_cont_receive(int fd, struct mr_params *reply)
     }
 
   reply->mr_filled += more;
-  
+
   if (reply->mr_filled != length)
     return -1;
 
@@ -170,6 +184,11 @@ int mr_cont_receive(int fd, struct mr_params *reply)
 
   getlong(reply->mr_flattened + 8, reply->u.mr_status);
   getlong(reply->mr_flattened + 12, reply->mr_argc);
+  if (reply->mr_argc > ((int)length - 16) / 8)
+    {
+      mr_destroy_reply(*reply);
+      return MR_INTERNAL;
+    }
   reply->mr_argv = malloc(reply->mr_argc * sizeof(char *));
   reply->mr_argl = malloc(reply->mr_argc * sizeof(int));
   if (reply->mr_argc && (!reply->mr_argv || !reply->mr_argl))
@@ -178,13 +197,23 @@ int mr_cont_receive(int fd, struct mr_params *reply)
       return ENOMEM;
     }
 
-  for (i = 0, p = (char *)reply->mr_flattened + 16; i < reply->mr_argc; i++)
+  p = (char *)reply->mr_flattened + 16;
+  end = (char *)reply->mr_flattened + length;
+  for (i = 0; i < reply->mr_argc && p + 4 <= end; i++)
     {
       getlong(p, reply->mr_argl[i]);
+      if (p + 4 + reply->mr_argl[i] > end)
+       break;
       reply->mr_argv[i] = p + 4;
       p += 4 + reply->mr_argl[i] + (4 - reply->mr_argl[i] % 4) % 4;
     }
 
+  if (i != reply->mr_argc)
+    {
+      mr_destroy_reply(*reply);
+      return MR_INTERNAL;
+    }
+
   return MR_SUCCESS;
 }