Re: [PATCH 1/2] server: Added server side named pipe read and write implementation and use it for message mode pipes.

[Sebastian Lackner]

On 28.02.2017 14:14, Jacek Caban wrote:
> +    LIST_FOR_EACH_ENTRY( message, &pipe_end->message_queue, struct pipe_message, entry )
> +        avail += message->iosb->in_size - message->read_pos;
> +    reply_size = min( reply_size, avail );
> +
> +    if (avail)
> +    {
> +        message = LIST_ENTRY( list_head(&pipe_end->message_queue), struct pipe_message, entry );
> +        reply_size = min( reply_size, message->iosb->in_size );
> +    }

Isn't there a problem with this size check? Lets assume we have two messages
with 10 byte, for the first one the read_pos = 5. Then avail == 15, and reply_size
is clamped to 10 - but it will attempt to copy 10 bytes starting position 5?
> +
> +    if (!(buffer = set_reply_data_size(FIELD_OFFSET( FILE_PIPE_PEEK_BUFFER, Data[reply_size] )))) return;
> +    buffer->NamedPipeState    = 0;  /* FIXME */
> +    buffer->ReadDataAvailable = avail;
> +    buffer->NumberOfMessages  = 0;  /* FIXME */
> +    buffer->MessageLength     = 0;  /* FIXME */
> +    if (avail) memcpy( buffer->Data, (const char *)message->iosb->in_data + message->read_pos, reply_size );
> +}
> +