Changeset 578 for branches/samba-3.3.x/source/lib

Timestamp:

Jun 25, 2011, 7:14:41 PM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 to 3.3.15 (security update)

Location:

branches/samba-3.3.x/source/lib

Files:

• events.c (modified) (2 diffs)
• packet.c (modified) (1 diff)
• readline.c (modified) (1 diff)
• select.c (modified) (2 diffs)
• util_sock.c (modified) (3 diffs)

branches/samba-3.3.x/source/lib/events.c

@@ -141 +141 @@
         struct fd_event *fde;
 
+        if (fd < 0 || fd >= FD_SETSIZE) {
+                errno = EBADF;
+                return NULL;
+        }
+
         if (!(fde = TALLOC_P(mem_ctx, struct fd_event))) {
                 return NULL;
@@ -191 +196 @@
 
         for (fde = event_ctx->fd_events; fde; fde = fde->next) {
+                if (fde->fd < 0 || fde->fd >= FD_SETSIZE) {
+                        /* We ignore here, as it shouldn't be
+                           possible to add an invalid fde->fd
+                           but we don't want FD_SET to see an
+                           invalid fd. */
+                        continue;
+                }
+
                 if (fde->flags & EVENT_FD_READ) {
                         FD_SET(fde->fd, read_fds);

branches/samba-3.3.x/source/lib/packet.c

@@ -107 +107 @@
         fd_set r_fds;
 
+        if (ctx->fd < 0 || ctx->fd >= FD_SETSIZE) {
+                errno = EBADF;
+                return map_nt_error_from_unix(errno);
+        }
+
         FD_ZERO(&r_fds);
         FD_SET(ctx->fd, &r_fds);

branches/samba-3.3.x/source/lib/readline.c

@@ -92 +92 @@
                 timeout.tv_usec = 0;
 
+                if (fd < 0 || fd >= FD_SETSIZE) {
+                        errno = EBADF;
+                        break;
+                }
+
                 FD_ZERO(&fds);
                 FD_SET(fd,&fds);

branches/samba-3.3.x/source/lib/select.c

@@ -66 +66 @@
                         smb_panic("Could not create select pipe");
 
+                if (select_pipe[0] < 0 || select_pipe[0] >= FD_SETSIZE) {
+                        errno = EBADF;
+                        return -1;
+                }
+
                 /*
                  * These next two lines seem to fix a bug with the Linux
@@ -92 +97 @@
                 FD_ZERO(readfds2);
         }
+
         FD_SET(select_pipe[0], readfds2);
 

branches/samba-3.3.x/source/lib/util_sock.c

@@ -961 +961 @@
 
         for (nread=0; nread < mincnt; ) {
+                if (fd < 0 || fd >= FD_SETSIZE) {
+                        errno = EBADF;
+                        return map_nt_error_from_unix(EBADF);
+                }
+
                 FD_ZERO(&fds);
                 FD_SET(fd,&fds);
@@ -1493 +1498 @@
         for (i=0; i<num_addrs; i++) {
                 sockets[i] = socket(addrs[i].ss_family, SOCK_STREAM, 0);
-                if (sockets[i] < 0)
+                if (sockets[i] < 0 || sockets[i] >= FD_SETSIZE)
                         goto done;
                 set_blocking(sockets[i], false);
@@ -1542 +1547 @@
 
         for (i=0; i<num_addrs; i++) {
-                if (sockets[i] == -1)
+                if (sockets[i] < 0 || sockets[i] >= FD_SETSIZE) {
+                        /* This cannot happen - ignore if so. */
                         continue;
+                }
                 FD_SET(sockets[i], &wr_fds);
                 FD_SET(sockets[i], &r_fds);