empire/empserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix lwpSleepFd()'s guard against unusable fd

Browse source 
0 <= fd < FD_SETSIZE must hold, or else undefined behavior in FD_SET()
and buffer overrun in LwpFdwait[fd].  Check of upper bound off by one,
check of lower bound missing.
This commit is contained in:
Markus Armbruster 2011-10-29 17:11:18 +02:00
parent 0b66d8e281
commit 55e689fb31
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/lib/lwp/sel.c
View file

@ -29,7 +29,7 @@
*
* Known contributors to this file:
* Dave Pare, 1994
* Markus Armbruster, 2007
* Markus Armbruster, 2007-2011
* Ron Koenderink, 2009
*/
@ -81,7 +81,7 @@ lwpSleepFd(int fd, int mask, struct timeval *timeout)
{
lwpStatus(LwpCurrent, "sleeping on fd %d for %d", fd, mask);
if (CANT_HAPPEN(fd > FD_SETSIZE)) {
if (CANT_HAPPEN(fd < 0 || fd >= FD_SETSIZE)) {
errno = EBADF;
return -1;
}