shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-02-19 21:57:27 +03:00
Code

shared: refuse fd == INT_MAX

Browse Source 
Since we do `FD_TO_PTR(fd)` that expands to `INT_TO_PTR(fd) + 1` which
triggers an integer overflow.

Resolves: #27522
(cherry picked from commit cc938f1ce0f1eafc435e0dd1d9fe45aaedc526e1)
(cherry picked from commit 154b108513fe4aa50e7f347abeb0f0d9789a32df)
This commit is contained in:
Frantisek Sumsal 2023-05-04 16:45:36 +02:00 committed by Luca Boccassi
parent ac7c88ae02
commit dd38a90202
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/shared/fdset.c
View File

@ -74,6 +74,10 @@ int fdset_put(FDSet *s, int fd) {
assert(s);
assert(fd >= 0);
/* Avoid integer overflow in FD_TO_PTR() */
if (fd == INT_MAX)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Refusing invalid fd: %d", fd);
return set_put(MAKE_SET(s), FD_TO_PTR(fd));
}
@ -100,6 +104,12 @@ bool fdset_contains(FDSet *s, int fd) {
assert(s);
assert(fd >= 0);
/* Avoid integer overflow in FD_TO_PTR() */
if (fd == INT_MAX) {
log_debug("Refusing invalid fd: %d", fd);
return false;
}
return !!set_get(MAKE_SET(s), FD_TO_PTR(fd));
}
@ -107,6 +117,10 @@ int fdset_remove(FDSet *s, int fd) {
assert(s);
assert(fd >= 0);
/* Avoid integer overflow in FD_TO_PTR() */
if (fd == INT_MAX)
return log_debug_errno(SYNTHETIC_ERRNO(ENOENT), "Refusing invalid fd: %d", fd);
return set_remove(MAKE_SET(s), FD_TO_PTR(fd)) ? fd : -ENOENT;
}