From 6d8ed33ba708ad51ff14db3927657b1a7b33210f Mon Sep 17 00:00:00 2001
From: David du Colombier <0intro@gmail.com>
Date: Fri, 13 Dec 2002 00:00:00 +0000
Subject: [PATCH] Plan 9 from Bell Labs 2002-12-13

---
 pc/kbd.c       |  2 +-
 port/devdraw.c |  5 +++++
 port/devmnt.c  | 40 +++++++++++++++++++++++++++-------------
 3 files changed, 33 insertions(+), 14 deletions(-)

diff --git a/pc/kbd.c b/pc/kbd.c
index bc85b100a0fdf8e19e7ead2c13471b6683462767..c8b8891a531a56c34770829737b6c5047da91fba 100644
--- a/pc/kbd.c
+++ b/pc/kbd.c
@@ -383,7 +383,7 @@ i8042intr(Ureg*, void*)
 			 * come back into focus, Plan 9 thinks you want to type
 			 * a compose sequence (you just typed alt). 
 			 *
-			 * As a clusmy hack around this, we look for ctl-alt
+			 * As a clumsy hack around this, we look for ctl-alt
 			 * and don't treat it as the start of a compose sequence.
 			 */
 			if(!ctl){
diff --git a/port/devdraw.c b/port/devdraw.c
index 3619d5a0101d61e5bb7bda21233475ed1e034c3a..451b20c3d34f07cb0320d228d91a0b7f4c40f3e4 100644
--- a/port/devdraw.c
+++ b/port/devdraw.c
@@ -385,6 +385,11 @@ dstflush(int dstid, Memimage *dst, Rectangle r)
 		combinerect(&flushrect, r);
 		return;
 	}
+	/* how can this happen? -rsc, dec 12 2002 */
+	if(dst == 0){
+		print("nil dstflush\n");
+		return;
+	}
 	l = dst->layer;
 	if(l == nil)
 		return;
diff --git a/port/devmnt.c b/port/devmnt.c
index c15058ec442fde857bedc56a4fd250f30df949e5..ed9c041a0370b280ad90c92fcdc387b8d260ebba 100644
--- a/port/devmnt.c
+++ b/port/devmnt.c
@@ -829,6 +829,24 @@ mountio(Mnt *m, Mntrpc *r)
 	mntflushfree(m, r);
 }
 
+static int
+doread(Mnt *m, int len)
+{
+	Block *b;
+
+	while(qlen(m->q) < len){
+		b = devtab[m->c->type]->bread(m->c, m->msize, 0);
+		if(b == nil)
+			return -1;
+		if(BLEN(b) == 0){
+			freeblist(b);
+			return -1;
+		}
+		qaddlist(m->q, b);
+	}
+	return 0;
+}
+
 int
 mntrpcread(Mnt *m, Mntrpc *r)
 {
@@ -839,22 +857,18 @@ mntrpcread(Mnt *m, Mntrpc *r)
 	r->reply.tag = 0;
 
 	/* read at least length, type, and tag and pullup to a single block */
-	while(qlen(m->q) < BIT32SZ+BIT8SZ+BIT16SZ){
-		b = devtab[m->c->type]->bread(m->c, m->msize, 0);
-		if(b == nil)
-			return -1;
-		qaddlist(m->q, b);
-	}
+	if(doread(m, BIT32SZ+BIT8SZ+BIT16SZ) < 0)
+		return -1;
 	nb = pullupqueue(m->q, BIT32SZ+BIT8SZ+BIT16SZ);
-	len = GBIT32(nb->rp);
 
-	/* read in the rest of the message */
-	while(qlen(m->q) < len){
-		b = devtab[m->c->type]->bread(m->c, m->msize, 0);
-		if(b == nil)
-			return -1;
-		qaddlist(m->q, b);
+	/* read in the rest of the message, avoid rediculous (for now) message sizes */
+	len = GBIT32(nb->rp);
+	if(len > m->msize){
+		qdiscard(m->q, qlen(m->q));
+		return -1;
 	}
+	if(doread(m, len) < 0)
+		return -1;
 
 	/* pullup the header (i.e. everything except data) */
 	t = nb->rp[BIT32SZ];