file_cache_write() can get a NULL buffer and still a size != 0, which the

request handling wasn't taking into account.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@37640 a95241bf-73f2-0310-859d-f6bbb57e9c96

headers/private/userlandfs/private/Requests.h

@@ -1838,6 +1838,7 @@ public:
 
 	void*		cookie;
 	Address		buffer;
+	size_t		size;
 	off_t		pos;
 };
 

src/add-ons/kernel/file_systems/userlandfs/kernel_add_on/KernelRequestHandler.cpp

@@ -706,9 +706,17 @@ KernelRequestHandler::_HandleRequest(FileCacheWriteRequest* request)
 
 	size_t size = 0;
 	if (result == B_OK) {
-		size = request->buffer.GetSize();
+		const void* data = request->buffer.GetData();
-		result = volume->WriteFileCache(request->vnid, request->cookie,
+		size = request->size;
-			request->pos, request->buffer.GetData(), &size);
+		if (data != NULL) {
+			if (size != (size_t)request->buffer.GetSize())
+				result = B_BAD_DATA;
+		}
+
+		if (result == B_OK) {
+			result = volume->WriteFileCache(request->vnid, request->cookie,
+				request->pos, data, &size);
+		}
 	}
 
 	// prepare the reply

src/add-ons/kernel/file_systems/userlandfs/server/kernel_emu.cpp

@@ -824,11 +824,15 @@ UserlandFS::KernelEmu::file_cache_write(dev_t mountID, ino_t vnodeID,
 	request->nsid = mountID;
 	request->vnid = vnodeID;
 	request->cookie = cookie;
+	request->size = *_size;
 	request->pos = offset;
 
-	error = allocator.AllocateData(request->buffer, buffer, *_size, 1, false);
+	if (buffer != NULL) {
-	if (error != B_OK)
+		error = allocator.AllocateData(request->buffer, buffer, *_size, 1,
-		return error;
+			false);
+		if (error != B_OK)
+			return error;
+	}
 
 	// send the request
 	UserlandRequestHandler handler(fileSystem, FILE_CACHE_WRITE_REPLY);