From: VMware, Inc <>
Date: Tue, 19 Oct 2010 18:42:09 +0000 (-0700)
Subject: Fix forwards compatibility with HGFS server
X-Git-Tag: 2010.10.18-313025~73
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8bffb0f3393741ec12ebdce918459f9a66eeeaea;p=thirdparty%2Fopen-vm-tools.git

Fix forwards compatibility with HGFS server

HGFS server pack reply for operations fail to set reserved fields
to zero. This means that if these reply fields need to be used
in the future HGFS clients would not be able to trust the values.
The reserved fields must be returned with zero until used.

Signed-off-by: Marcelo Vanzin <mvanzin@vmware.com>
---

diff --git a/open-vm-tools/lib/hgfsServer/hgfsServer.c b/open-vm-tools/lib/hgfsServer/hgfsServer.c
index 4b955b384..70ca23a07 100644
--- a/open-vm-tools/lib/hgfsServer/hgfsServer.c
+++ b/open-vm-tools/lib/hgfsServer/hgfsServer.c
@@ -4566,6 +4566,7 @@ HgfsAllocInitReply(HgfsPacket *packet,           // IN/OUT: Hgfs Packet
    reply = HSPU_GetReplyPacket(packet, &replyPacketSize, session);
 
    if (reply && (replyPacketSize >= headerSize + payloadSize)) {
+      memset(reply, 0, headerSize + payloadSize);
       result = TRUE;
       if (payloadSize > 0) {
          *payload = reply + headerSize;
@@ -4634,6 +4635,7 @@ HgfsServerRead(HgfsInputParam *input)  // IN: Input params
                                                 requiredSize, payload,
                                                 &reply->actualSize);
                   if (HGFS_ERROR_SUCCESS == status) {
+                     reply->reserved = 0;
                      replyPayloadSize = sizeof *reply +
                                          ((inlineDataSize > 0) ? reply->actualSize : 0);
                   }
diff --git a/open-vm-tools/lib/hgfsServer/hgfsServerParameters.c b/open-vm-tools/lib/hgfsServer/hgfsServerParameters.c
index 813cf001b..d9330ac87 100644
--- a/open-vm-tools/lib/hgfsServer/hgfsServerParameters.c
+++ b/open-vm-tools/lib/hgfsServer/hgfsServerParameters.c
@@ -1001,6 +1001,8 @@ HgfsPackCloseReply(HgfsPacket *packet,         // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply consists of a reserved field only. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
@@ -1059,7 +1061,7 @@ HgfsUnpackSearchClosePayload(HgfsRequestSearchClose *request, // IN: payload
 /*
  *-----------------------------------------------------------------------------
  *
- * HgfsUnpackClosePayloadV3 --
+ * HgfsUnpackSearchClosePayloadV3 --
  *
  *    Unpack hgfs search close payload V3 to get the search handle which need to
  *    be closed.
@@ -1179,6 +1181,8 @@ HgfsPackSearchCloseReply(HgfsPacket *packet,         // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply consists of only a reserved field. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
@@ -2003,6 +2007,8 @@ HgfsPackRenameReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply consists of only a reserved field. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
@@ -3150,6 +3156,8 @@ HgfsPackSetattrReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply consists of only a reserved field. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
@@ -3449,6 +3457,8 @@ HgfsPackCreateDirReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply consists of only a reserved field. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
@@ -3610,6 +3620,7 @@ HgfsPackWriteWin32StreamReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                  (void **)&reply, session);
       if (result) {
+         reply->reserved = 0;
          reply->actualSize = actualSize;
          *payloadSize = sizeof *reply;
       }
@@ -3987,6 +3998,7 @@ HgfsPackWriteReply(HgfsPacket *packet,           // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         reply->reserved = 0;
          reply->actualSize = actualSize;
          *payloadSize = sizeof *reply;
       }
@@ -4189,6 +4201,7 @@ HgfsPackQueryVolumeReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         reply->reserved = 0;
          reply->freeBytes = freeBytes;
          reply->totalBytes = totalBytes;
          *payloadSize = sizeof *reply;
@@ -4432,17 +4445,19 @@ HgfsPackSymlinkCreateReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
 
    switch (op) {
    case HGFS_OP_CREATE_SYMLINK_V3: {
-      HgfsReplyQueryVolumeV3 *reply;
+      HgfsReplySymlinkCreateV3 *reply;
 
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply only consists of a reserved field. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
    }
    case HGFS_OP_CREATE_SYMLINK: {
-      HgfsReplyQueryVolume *reply;
+      HgfsReplySymlinkCreate *reply;
 
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
@@ -4632,6 +4647,7 @@ HgfsPackSearchOpenReply(HgfsPacket *packet,          // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         reply->reserved = 0;
          reply->search = search;
          *payloadSize = sizeof *reply;
       }
@@ -4809,11 +4825,19 @@ HgfsPackDestorySessionReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
                             HgfsSessionInfo *session)  // IN: Session info
 {
    HgfsReplyDestroySessionV4 *reply;
+   Bool result;
 
    HGFS_ASSERT_PACK_PARAMS;
 
    *payloadSize = 0;
 
-   return HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
-                             (void **)&reply, session);
+   result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
+                               (void **)&reply, session);
+   if (result) {
+      /* Reply only consists of a reserved field. */
+      *payloadSize = sizeof *reply;
+      reply->reserved = 0;
+   }
+
+   return result;
 }