Actually, the server receives an out-of-band msg inline, tries to translate
it into a 4-byte integer (ending up with a very large negative number) and
then uses that offset to set the "end" of the string to 0, causing a SIGSEGV
The following patch adds code which checks for a negative offset and, if
found, returns an error.
*** net.c 1997/08/13 14:25:44 1.1
--- net.c 1997/08/13 14:36:39
***************
*** 158,163 ****
--- 158,169 ----
alarm(0);
return(-1);
}
+ if (len < 0)
+ {
+ fprintf(stderr,"Packet too small (%d)\n", len);
+ alarm(0);
+ return(-1);
+ }
remain = len;
offset = 0;
while(remain > 0)