empire/empserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix lwpSleepFd()'s guard against unusable fd

Browse source 
0 <= fd < FD_SETSIZE must hold, or else undefined behavior in FD_SET()
and buffer overrun in LwpFdwait[fd].  Check of upper bound off by one,
check of lower bound missing.
This commit is contained in:
Markus Armbruster 2011-10-29 17:11:18 +02:00
parent 0b66d8e281
commit 55e689fb31
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/lib/lwp/sel.c
View file

@ -29,7 +29,7 @@
* *
* Known contributors to this file: * Known contributors to this file:
* Dave Pare, 1994 * Dave Pare, 1994
* Markus Armbruster, 2007 * Markus Armbruster, 2007-2011
* Ron Koenderink, 2009 * Ron Koenderink, 2009
*/ */
@ -81,7 +81,7 @@ lwpSleepFd(int fd, int mask, struct timeval *timeout)
{ {
lwpStatus(LwpCurrent, "sleeping on fd %d for %d", fd, mask); lwpStatus(LwpCurrent, "sleeping on fd %d for %d", fd, mask);
if (CANT_HAPPEN(fd > FD_SETSIZE)) { if (CANT_HAPPEN(fd < 0 || fd >= FD_SETSIZE)) {
errno = EBADF; errno = EBADF;
return -1; return -1;
} }