Changeset 2132

Show
Ignore:
Timestamp:
03/21/2008 02:50:03 PM (4 months ago)
Author:
stbuehler
Message:

fixed out of range access in fd array (#1562, #372, #1603) (CVE-2008-0983)

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/NEWS

    r2131 r2132  
    2323  * fixed building/testing outside of the src dir 
    2424  * fix many (64-bit) format warnings and unsigned/signed compare warnings 
     25  * fixed out of range access in fd array (#1562, #372, #1603) (CVE-2008-0983) 
    2526 
    2627- 1.5.0-r19.. - 

  • trunk/src/fdevent_solaris_devpoll.c

    r2006 r2132  
    6969 
    7070        dopoll.dp_timeout = timeout_ms; 
    71         dopoll.dp_nfds = ev->maxfds; 
     71        dopoll.dp_nfds = ev->maxfds - 1; 
    7272        dopoll.dp_fds = ev->devpollfds; 
    7373 

  • trunk/src/server.c

    r2131 r2132  
    12651265                } 
    12661266 
    1267                 /* #372: solaris need some fds extra for devpoll */ 
    1268                 if (rlim.rlim_cur > 10) rlim.rlim_cur -= 10; 
    1269  
    12701267                if (srv->event_handler == FDEVENT_HANDLER_SELECT) { 
    12711268                        srv->max_fds = rlim.rlim_cur < FD_SETSIZE - 200 ? rlim.rlim_cur : FD_SETSIZE - 200; 
    …… 
    16101607#endif 
    16111608 
    1612         if (NULL == (srv->ev = fdevent_init(/*srv->max_fds + 1*/ 4096, srv->event_handler))) { 
     1609        if (NULL == (srv->ev = fdevent_init(srv->max_fds + 1, srv->event_handler))) { 
    16131610                log_error_write(srv, __FILE__, __LINE__, 
    16141611                                "s", "fdevent_init failed");