Fix forwards compatibility with HGFS server

HGFS server pack reply for operations fail to set reserved fields
to zero. This means that if these reply fields need to be used
in the future HGFS clients would not be able to trust the values.
The reserved fields must be returned with zero until used.

Signed-off-by: Marcelo Vanzin <mvanzin@vmware.com>

diff --git a/open-vm-tools/lib/hgfsServer/hgfsServer.c b/open-vm-tools/lib/hgfsServer/hgfsServer.c
index 4b955b384f831944436d9536112c4b8eed7447c8..70ca23a07f15f025eb722520de9613aeaf8bf020 100644 (file)
--- a/open-vm-tools/lib/hgfsServer/hgfsServer.c
+++ b/open-vm-tools/lib/hgfsServer/hgfsServer.c
@@ -4566,6 +4566,7 @@ HgfsAllocInitReply(HgfsPacket *packet,           // IN/OUT: Hgfs Packet
    reply = HSPU_GetReplyPacket(packet, &replyPacketSize, session);
 
    if (reply && (replyPacketSize >= headerSize + payloadSize)) {
+      memset(reply, 0, headerSize + payloadSize);
       result = TRUE;
       if (payloadSize > 0) {
          *payload = reply + headerSize;
@@ -4634,6 +4635,7 @@ HgfsServerRead(HgfsInputParam *input)  // IN: Input params
                                                 requiredSize, payload,
                                                 &reply->actualSize);
                   if (HGFS_ERROR_SUCCESS == status) {
+                     reply->reserved = 0;
                      replyPayloadSize = sizeof *reply +
                                          ((inlineDataSize > 0) ? reply->actualSize : 0);
                   }

diff --git a/open-vm-tools/lib/hgfsServer/hgfsServerParameters.c b/open-vm-tools/lib/hgfsServer/hgfsServerParameters.c
index 813cf001b7ad09b1d712ca4c3215118bd651ea38..d9330ac87014aaca88bca32b0f39edb430631b93 100644 (file)
--- a/open-vm-tools/lib/hgfsServer/hgfsServerParameters.c
+++ b/open-vm-tools/lib/hgfsServer/hgfsServerParameters.c
@@ -1001,6 +1001,8 @@ HgfsPackCloseReply(HgfsPacket *packet,         // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply consists of a reserved field only. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
@@ -1059,7 +1061,7 @@ HgfsUnpackSearchClosePayload(HgfsRequestSearchClose *request, // IN: payload
 /*
  *-----------------------------------------------------------------------------
  *
- * HgfsUnpackClosePayloadV3 --
+ * HgfsUnpackSearchClosePayloadV3 --
  *
  *    Unpack hgfs search close payload V3 to get the search handle which need to
  *    be closed.
@@ -1179,6 +1181,8 @@ HgfsPackSearchCloseReply(HgfsPacket *packet,         // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply consists of only a reserved field. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
@@ -2003,6 +2007,8 @@ HgfsPackRenameReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply consists of only a reserved field. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
@@ -3150,6 +3156,8 @@ HgfsPackSetattrReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply consists of only a reserved field. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
@@ -3449,6 +3457,8 @@ HgfsPackCreateDirReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply consists of only a reserved field. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
@@ -3610,6 +3620,7 @@ HgfsPackWriteWin32StreamReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                  (void **)&reply, session);
       if (result) {
+         reply->reserved = 0;
          reply->actualSize = actualSize;
          *payloadSize = sizeof *reply;
       }
@@ -3987,6 +3998,7 @@ HgfsPackWriteReply(HgfsPacket *packet,           // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         reply->reserved = 0;
          reply->actualSize = actualSize;
          *payloadSize = sizeof *reply;
       }
@@ -4189,6 +4201,7 @@ HgfsPackQueryVolumeReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         reply->reserved = 0;
          reply->freeBytes = freeBytes;
          reply->totalBytes = totalBytes;
          *payloadSize = sizeof *reply;
@@ -4432,17 +4445,19 @@ HgfsPackSymlinkCreateReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
 
    switch (op) {
    case HGFS_OP_CREATE_SYMLINK_V3: {
-      HgfsReplyQueryVolumeV3 *reply;
+      HgfsReplySymlinkCreateV3 *reply;
 
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         /* Reply only consists of a reserved field. */
+         reply->reserved = 0;
          *payloadSize = sizeof *reply;
       }
       break;
    }
    case HGFS_OP_CREATE_SYMLINK: {
-      HgfsReplyQueryVolume *reply;
+      HgfsReplySymlinkCreate *reply;
 
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
@@ -4632,6 +4647,7 @@ HgfsPackSearchOpenReply(HgfsPacket *packet,          // IN/OUT: Hgfs Packet
       result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
                                   (void **)&reply, session);
       if (result) {
+         reply->reserved = 0;
          reply->search = search;
          *payloadSize = sizeof *reply;
       }
@@ -4809,11 +4825,19 @@ HgfsPackDestorySessionReply(HgfsPacket *packet,        // IN/OUT: Hgfs Packet
                             HgfsSessionInfo *session)  // IN: Session info
 {
    HgfsReplyDestroySessionV4 *reply;
+   Bool result;
 
    HGFS_ASSERT_PACK_PARAMS;
 
    *payloadSize = 0;
 
-   return HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
-                             (void **)&reply, session);
+   result = HgfsAllocInitReply(packet, packetHeader, sizeof *reply,
+                               (void **)&reply, session);
+   if (result) {
+      /* Reply only consists of a reserved field. */
+      *payloadSize = sizeof *reply;
+      reply->reserved = 0;
+   }
+
+   return result;
 }