From 0716cb868e847bb9f66c659f8662d905ba012de8 Mon Sep 17 00:00:00 2001 From: Sam Roberts Date: Tue, 21 Feb 2012 13:13:46 -0800 Subject: [PATCH] Bounds check the argument to FD_SET Failing to check the FD_SET argument against FD_SETSIZE causes undefined behaviour (segfaults, for example). --- src/usocket.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/usocket.c b/src/usocket.c index 3221cb9..f4c0a84 100644 --- a/src/usocket.c +++ b/src/usocket.c @@ -49,6 +49,7 @@ int socket_waitfd(p_socket ps, int sw, p_timeout tm) { fd_set rfds, wfds, *rp, *wp; struct timeval tv, *tp; double t; + if (*ps >= FD_SETSIZE) return EINVAL; if (timeout_iszero(tm)) return IO_TIMEOUT; /* optimize timeout == 0 case */ do { /* must set bits within loop, because select may have modifed them */