die if fd_set overruns.

This commit is contained in:
itojun 2002-08-09 02:43:58 +00:00
parent 1917442aa9
commit 98e97a1b2b
2 changed files with 28 additions and 8 deletions

View File

@ -1,4 +1,4 @@
/* $NetBSD: sys-bsd.c,v 1.38 2002/07/01 22:19:41 itojun Exp $ */ /* $NetBSD: sys-bsd.c,v 1.39 2002/08/09 02:43:58 itojun Exp $ */
/* /*
* sys-bsd.c - System-dependent procedures for setting up * sys-bsd.c - System-dependent procedures for setting up
@ -64,7 +64,7 @@
#if 0 #if 0
#define RCSID "Id: sys-bsd.c,v 1.47 2000/04/13 12:04:23 paulus Exp " #define RCSID "Id: sys-bsd.c,v 1.47 2000/04/13 12:04:23 paulus Exp "
#else #else
__RCSID("$NetBSD: sys-bsd.c,v 1.38 2002/07/01 22:19:41 itojun Exp $"); __RCSID("$NetBSD: sys-bsd.c,v 1.39 2002/08/09 02:43:58 itojun Exp $");
#endif #endif
#endif #endif
@ -978,6 +978,8 @@ wait_input(timo)
void add_fd(fd) void add_fd(fd)
int fd; int fd;
{ {
if (fd >= FD_SETSIZE)
fatal("descriptor too big");
FD_SET(fd, &in_fds); FD_SET(fd, &in_fds);
if (fd > max_in_fd) if (fd > max_in_fd)
max_in_fd = fd; max_in_fd = fd;
@ -1006,6 +1008,8 @@ wait_loop_output(timo)
int n; int n;
FD_ZERO(&ready); FD_ZERO(&ready);
if (loop_master >= FD_SETSIZE)
fatal("descriptor too big");
FD_SET(loop_master, &ready); FD_SET(loop_master, &ready);
n = select(loop_master + 1, &ready, NULL, &ready, timo); n = select(loop_master + 1, &ready, NULL, &ready, timo);
if (n < 0 && errno != EINTR) if (n < 0 && errno != EINTR)

View File

@ -1,4 +1,4 @@
/* $NetBSD: tty.c,v 1.4 2002/08/02 02:52:07 christos Exp $ */ /* $NetBSD: tty.c,v 1.5 2002/08/09 02:43:58 itojun Exp $ */
/* /*
* tty.c - code for handling serial ports in pppd. * tty.c - code for handling serial ports in pppd.
@ -27,7 +27,7 @@
#if 0 #if 0
#define RCSID "Id: tty.c,v 1.6 2001/03/12 22:59:01 paulus Exp " #define RCSID "Id: tty.c,v 1.6 2001/03/12 22:59:01 paulus Exp "
#else #else
__RCSID("$NetBSD: tty.c,v 1.4 2002/08/02 02:52:07 christos Exp $"); __RCSID("$NetBSD: tty.c,v 1.5 2002/08/09 02:43:58 itojun Exp $");
#endif #endif
#endif #endif
@ -1006,17 +1006,29 @@ charshunt(ifd, ofd, record_file)
if (nibuf != 0) { if (nibuf != 0) {
if (ilevel >= max_level) if (ilevel >= max_level)
top = &tout; top = &tout;
else else {
if (pty_master >= FD_SETSIZE)
fatal("descriptor too big");
FD_SET(pty_master, &writey); FD_SET(pty_master, &writey);
} else if (stdin_readable) }
} else if (stdin_readable) {
if (ifd >= FD_SETSIZE)
fatal("descriptor too big");
FD_SET(ifd, &ready); FD_SET(ifd, &ready);
}
if (nobuf != 0) { if (nobuf != 0) {
if (olevel >= max_level) if (olevel >= max_level)
top = &tout; top = &tout;
else else {
if (ofd >= FD_SETSIZE)
fatal("descriptor too big");
FD_SET(ofd, &writey); FD_SET(ofd, &writey);
} else if (pty_readable) }
} else if (pty_readable) {
if (pty_master >= FD_SETSIZE)
fatal("descriptor too big");
FD_SET(pty_master, &ready); FD_SET(pty_master, &ready);
}
if (select(nfds, &ready, &writey, NULL, top) < 0) { if (select(nfds, &ready, &writey, NULL, top) < 0) {
if (errno != EINTR) if (errno != EINTR)
fatal("select"); fatal("select");
@ -1057,6 +1069,8 @@ charshunt(ifd, ofd, record_file)
if (!record_write(recordf, 4, NULL, 0, &lasttime)) if (!record_write(recordf, 4, NULL, 0, &lasttime))
recordf = NULL; recordf = NULL;
} else { } else {
if (pty_master >= FD_SETSIZE)
fatal("descriptor too big");
FD_SET(pty_master, &writey); FD_SET(pty_master, &writey);
if (recordf) if (recordf)
if (!record_write(recordf, 2, ibufp, nibuf, &lasttime)) if (!record_write(recordf, 2, ibufp, nibuf, &lasttime))
@ -1084,6 +1098,8 @@ charshunt(ifd, ofd, record_file)
if (!record_write(recordf, 3, NULL, 0, &lasttime)) if (!record_write(recordf, 3, NULL, 0, &lasttime))
recordf = NULL; recordf = NULL;
} else { } else {
if (ofd >= FD_SETSIZE)
fatal("descriptor too big");
FD_SET(ofd, &writey); FD_SET(ofd, &writey);
if (recordf) if (recordf)
if (!record_write(recordf, 1, obufp, nobuf, &lasttime)) if (!record_write(recordf, 1, obufp, nobuf, &lasttime))