mirror of
https://github.com/systemd/systemd
synced 2024-10-15 12:34:37 +00:00
shared: refuse fd == INT_MAX
Since we do `FD_TO_PTR(fd)` that expands to `INT_TO_PTR(fd) + 1` which triggers an integer overflow. Resolves: #27522
This commit is contained in:
parent
77be02ad3c
commit
cc938f1ce0
|
@ -77,6 +77,10 @@ int fdset_put(FDSet *s, int fd) {
|
|||
assert(s);
|
||||
assert(fd >= 0);
|
||||
|
||||
/* Avoid integer overflow in FD_TO_PTR() */
|
||||
if (fd == INT_MAX)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Refusing invalid fd: %d", fd);
|
||||
|
||||
return set_put(MAKE_SET(s), FD_TO_PTR(fd));
|
||||
}
|
||||
|
||||
|
@ -115,6 +119,12 @@ bool fdset_contains(FDSet *s, int fd) {
|
|||
assert(s);
|
||||
assert(fd >= 0);
|
||||
|
||||
/* Avoid integer overflow in FD_TO_PTR() */
|
||||
if (fd == INT_MAX) {
|
||||
log_debug("Refusing invalid fd: %d", fd);
|
||||
return false;
|
||||
}
|
||||
|
||||
return !!set_get(MAKE_SET(s), FD_TO_PTR(fd));
|
||||
}
|
||||
|
||||
|
@ -122,6 +132,10 @@ int fdset_remove(FDSet *s, int fd) {
|
|||
assert(s);
|
||||
assert(fd >= 0);
|
||||
|
||||
/* Avoid integer overflow in FD_TO_PTR() */
|
||||
if (fd == INT_MAX)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(ENOENT), "Refusing invalid fd: %d", fd);
|
||||
|
||||
return set_remove(MAKE_SET(s), FD_TO_PTR(fd)) ? fd : -ENOENT;
|
||||
}
|
||||
|
||||
|
|
|
@ -0,0 +1,3 @@
|
|||
|
||||
l.socket
|
||||
socket=2147483647 5
|
Loading…
Reference in a new issue