fdo-mirrors/libei
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/libinput/libei.git synced 2025-12-20 15:00:06 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

util: fix iobuf_append_fd OOB when we have too many fds

Browse source 
Cannot happen in deploymentts since we never have more than one anyway.

Fixes #43
This commit is contained in:
Peter Hutterer 2023-08-30 08:41:53 +10:00
parent b7ab63c386
commit 2fbd22984f
1 changed files with 24 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
src/util-io.c
View file

@ -281,7 +281,7 @@ int
iobuf_append_fd(struct iobuf *buf, int fd)
{
/* Array must remain terminated by -1 */
for (size_t idx = 0; idx < sizeof(buf->fds) - 1; idx ++) {
for (size_t idx = 0; idx < ARRAY_LENGTH(buf->fds) - 1; idx ++) {
if (buf->fds[idx] == -1) {
int f = dup(fd);
if (f == -1)
@ -629,6 +629,29 @@ MUNIT_TEST(test_iobuf_append_fd)
return MUNIT_OK;
}
MUNIT_TEST(test_iobuf_append_fd_too_many)
{
_cleanup_fclose_ FILE *fp = tmpfile();
int fd = fileno(fp);
_cleanup_iobuf_ struct iobuf *buf = iobuf_new(20);
const size_t nfds = ARRAY_LENGTH(buf->fds);
int *last_fd = &buf->fds[nfds - 1]; /* always -1 */
int err = 0;
size_t count = 0;
/* 32 fds hardcoded in the struct, last one is always -1 */
for (count = 0; err == 0 && count < nfds + 1; count++) {
err = iobuf_append_fd(buf, fd);
munit_assert_int(*last_fd, ==, -1);
}
munit_assert_int(count, ==, 32);
munit_assert_int(err, ==, -ENOMEM);
return MUNIT_OK;
}
MUNIT_TEST(test_iobuf_recv_fd)
{
int fds[2];