mirror of
https://gitlab.com/openconnect/ocserv.git
synced 2026-08-08 09:21:48 +08:00
Nikos Mavrogiannopoulos
879f723953
recv_remaining() is used only on the non-TLS CSTP path (a UNIX socket proxying plaintext CSTP in front of ocserv). On a recv() failure or peer close mid-read, it discarded the error and returned whatever partial byte count it had accumulated so far. Since every caller only checks "ret <= 0" and otherwise trusts the count as a complete read, a truncated body could come back as a positive, non-zero total that looked like success: _cstp_recv_packet() would then report the full 8+pktlen size to its caller with only part of the buffer actually populated from the network, feeding stale/uninitialized bytes into parse_cstp_data() as if they were received client data. Make the contract unambiguous: recv_remaining() now returns either exactly the requested byte count or a negative error - never a partial positive count a caller could mistake for success. Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>