Changeset 578 for branches/samba-3.3.x/source/winbindd

Timestamp:

Jun 25, 2011, 7:14:41 PM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 to 3.3.15 (security update)

Location:

branches/samba-3.3.x/source/winbindd

Files:

• winbindd.c (modified) (3 diffs)
• winbindd_dual.c (modified) (2 diffs)

branches/samba-3.3.x/source/winbindd/winbindd.c

@@ -837 +837 @@
         listen_priv_sock = open_winbindd_priv_socket();
 
-        if (listen_sock == -1 || listen_priv_sock == -1) {
+        if (listen_sock < 0 || listen_sock >= FD_SETSIZE ||
+                        listen_priv_sock < 0 || listen_priv_sock >= FD_SETSIZE) {
                 perror("open_winbind_socket");
                 exit(1);
@@ -862 +863 @@
         FD_ZERO(&r_fds);
         FD_ZERO(&w_fds);
+
+        /* We check the range for listen_sock and
+           listen_priv_sock above. */
         FD_SET(listen_sock, &r_fds);
         FD_SET(listen_priv_sock, &r_fds);
@@ -891 +895 @@
 
         for (ev = fd_events; ev; ev = ev->next) {
+                if (ev->fd < 0 || ev->fd >= FD_SETSIZE) {
+                        /* Ignore here - event_add_to_select_args
+                           should make this impossible. */
+                        continue;
+                }
+
                 if (ev->flags & EVENT_FD_READ) {
                         FD_SET(ev->fd, &r_fds);

branches/samba-3.3.x/source/winbindd/winbindd_dual.c

@@ -1251 +1251 @@
         }
 
+        if (fdpair[0] < 0 || fdpair[0] >= FD_SETSIZE) {
+                DEBUG(0, ("fork_domain_child: bad fd range (%d)\n", fdpair[0]));
+                errno = EBADF;
+                return False;
+        }
+
         ZERO_STRUCT(state);
         state.pid = sys_getpid();
@@ -1406 +1412 @@
 
                 FD_ZERO(&read_fds);
+                /* We check state.sock against FD_SETSIZE above. */
                 FD_SET(state.sock, &read_fds);