https://bugzilla.samba.org/show_bug.cgi?id=5075





------- Comment #2 from [EMAIL PROTECTED]  2007-11-12 00:17 CST -------
Sorry, I meant to add this too:

There is also an uninitialized variable in readfd_buffered that can cause
garbage to be read independently of the bug in mplex_write.  Under case
MSG_DELETED, inbuf.pos is never initialized which can -- and will -- cause the
call to iconvbufs further down to process random data.

The fix is to initialize inbuf with a proper call to INIT_XBUF before
proceeding to do the conversion.

Diff below and attached.

--- 510,515 ----
***************
*** 1060,1066 ****
                                int pos = 0;

                                INIT_CONST_XBUF(outbuf, line);
!                               inbuf.buf = ibuf;

                                while (msg_bytes) {
                                        inbuf.len = msg_bytes > sizeof ibuf
--- 1069,1075 ----
                                int pos = 0;

                                INIT_CONST_XBUF(outbuf, line);
!                               INIT_XBUF(inbuf, ibuf, 0, -1);

                                while (msg_bytes) {
                                        inbuf.len = msg_bytes > sizeof ibuf


-- 
Configure bugmail: https://bugzilla.samba.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.
-- 
To unsubscribe or change options: https://lists.samba.org/mailman/listinfo/rsync
Before posting, read: http://www.catb.org/~esr/faqs/smart-questions.html

Reply via email to