Import ITS#1983 fixes from HEAD. (Also fixes ITS#910, updates ITS#1861 fix.)

Fix large SASL reads and writes.

diff --git a/libraries/liblber/sockbuf.c b/libraries/liblber/sockbuf.c
index 5bec6ed81c089791297fd5fc70bbd1b9cfae8ef4..f4e13e332ba3e034661d8346ec02c5fe7df31e13 100644 (file)
--- a/libraries/liblber/sockbuf.c
+++ b/libraries/liblber/sockbuf.c
@@ -309,11 +309,6 @@ ber_pvt_sb_do_write( Sockbuf_IO_Desc *sbiod, Sockbuf_Buf *buf_out )
                buf_out->buf_end = buf_out->buf_ptr = 0;
        }
 
-       if ( (ber_len_t)ret < to_go ) {
-               /* not enough data, so pretend no data was sent. */
-               return -1;
-       }
-
        return ret;
 }
 

diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c
index a7d0f4b10840057c992a73b59d6ffba258e5763f..622248d430e77fe4c85d0de04670ed7fe3f69dc1 100644 (file)
--- a/libraries/libldap/cyrus.c
+++ b/libraries/libldap/cyrus.c
@@ -149,12 +149,16 @@ sb_sasl_pkt_length( const unsigned char *buf, unsigned max, int debuglevel )
                | buf[2] << 8
                | buf[3];
    
-       if ( size > max ) {
+       if ( size > SASL_MAX_BUFF_SIZE ) {
                /* somebody is trying to mess me up. */
                ber_log_printf( LDAP_DEBUG_ANY, debuglevel,
                        "sb_sasl_pkt_length: received illegal packet length "
                        "of %lu bytes\n", (unsigned long)size );      
                size = 16; /* this should lead to an error. */
+       } else if ( size > max ) {
+               ber_log_printf( LDAP_DEBUG_ANY, debuglevel,
+                       "sb_sasl_pkt_length: received packet length "
+                       "of %lu exceeds negotiated max of %lu bytes\n", (unsigned long)size, (unsigned long)max );
        }
 
        return size + 4; /* include the size !!! */
@@ -211,7 +215,7 @@ sb_sasl_read( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
                        continue;
 #endif
                if ( ret <= 0 )
-                       return ret;
+                       return bufptr ? bufptr : ret;
 
                p->sec_buf_in.buf_ptr += ret;
        }
@@ -240,7 +244,7 @@ sb_sasl_read( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
                        continue;
 #endif
                if ( ret <= 0 )
-                       return ret;
+                       return bufptr ? bufptr : ret;
 
                p->sec_buf_in.buf_ptr += ret;
        }
@@ -283,8 +287,13 @@ sb_sasl_write( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
        /* Are there anything left in the buffer? */
        if ( p->buf_out.buf_ptr != p->buf_out.buf_end ) {
                ret = ber_pvt_sb_do_write( sbiod, &p->buf_out );
-               if ( ret <= 0 )
+               if ( ret < 0 )
                        return ret;
+               /* Still have something left?? */
+               if ( p->buf_out.buf_ptr != p->buf_out.buf_end ) {
+                       errno = EAGAIN;
+                       return 0;
+               }
        }
 
        /* now encode the next packet. */