file: bail out of file_write_cb on read error

The static-file delivery loop in file_write_cb only handled the
EINTR branch of a failed read(); other failure modes (EIO on a
backing storage error, EBADF on an unexpectedly-closed fd, etc.)
fell through with r < 0 and reached uh_chunk_write(cl, uh_buf, r),
which forwards the negative length to ustream_write() where it is
interpreted as an unsigned size. The result is a chunked transfer
of arbitrary memory adjacent to uh_buf to the client.

On any non-EINTR read error, terminate the request like we already
do for EOF instead of writing past the buffer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

1 files changed, 3 insertions, 0 deletions

diff --git a/file.c b/file.c
index 230d3d6..ffade2a 100644
--- a/file.c
+++ b/file.c
@@ -597,6 +597,9 @@ static void file_write_cb(struct client *cl)
 		if (r < 0) {
 			if (errno == EINTR)
 				continue;
+
+			uh_request_done(cl);
+			return;
 		}
 
 		if (!r) {