Changeset 578 for branches/samba-3.3.x/source/nmbd/nmbd_packets.c

Timestamp:

Jun 25, 2011, 7:14:41 PM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 to 3.3.15 (security update)

File:

• branches/samba-3.3.x/source/nmbd/nmbd_packets.c (modified) (6 diffs)

branches/samba-3.3.x/source/nmbd/nmbd_packets.c

@@ -1684 +1684 @@
                 count++;
 
-        if((count*2) + 2 > FD_SETSIZE) {
+        if((count*2) + 2 >= FD_SETSIZE) {
                 DEBUG(0,("create_listen_fdset: Too many file descriptors needed (%d). We can \
 only use %d.\n", (count*2) + 2, FD_SETSIZE));
@@ -1700 +1700 @@
 
         /* Add in the broadcast socket on 137. */
+        if (ClientNMB < 0 || ClientNMB >= FD_SETSIZE) {
+                errno = EBADF;
+                SAFE_FREE(pset);
+                return True;
+        }
+
         FD_SET(ClientNMB,pset);
         sock_array[num++] = ClientNMB;
@@ -1706 +1712 @@
         /* Add in the 137 sockets on all the interfaces. */
         for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) {
+                if (subrec->nmb_sock < 0 || subrec->nmb_sock >= FD_SETSIZE) {
+                        /* We have to ignore sockets outside FD_SETSIZE. */
+                        continue;
+                }
                 FD_SET(subrec->nmb_sock,pset);
                 sock_array[num++] = subrec->nmb_sock;
@@ -1712 +1722 @@
 
         /* Add in the broadcast socket on 138. */
+        if (ClientDGRAM < 0 || ClientDGRAM >= FD_SETSIZE) {
+                errno = EBADF;
+                SAFE_FREE(pset);
+                return True;
+        }
+
         FD_SET(ClientDGRAM,pset);
         sock_array[num++] = ClientDGRAM;
@@ -1718 +1734 @@
         /* Add in the 138 sockets on all the interfaces. */
         for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) {
+                if (subrec->dgram_sock < 0 || subrec->dgram_sock >= FD_SETSIZE) {
+                        /* We have to ignore sockets outside FD_SETSIZE. */
+                        continue;
+                }
                 FD_SET(subrec->dgram_sock,pset);
                 sock_array[num++] = subrec->dgram_sock;
@@ -1768 +1788 @@
 #ifndef SYNC_DNS
         dns_fd = asyncdns_fd();
-        if (dns_fd != -1) {
+        if (dns_fd >= 0 && dns_fd < FD_SETSIZE) {
                 FD_SET(dns_fd, &r_fds);
                 maxfd = MAX( maxfd, dns_fd);