Skip to content

Commit

Permalink
Fix integer shift overflow if both tcp_socket and udp_socket are set
Browse files Browse the repository at this point in the history
The problem occurs if at the start of the loop the sockindex is at the
last valid ARES_GETSOCK_MAXNUM position. If then both udp_socket and
tcp_socket are valid, sockindex gets incremented for UDP first and
points one entry behind the array for the tcp block.
So the fix is to check after every increment of sockindex if it is still
valid.

Fix Coverity error CID 56878

Signed-off-by: Gregor Jasny <gjasny@googlemail.com>
  • Loading branch information
gjasny authored and daviddrysdale committed Sep 30, 2014
1 parent 13dc480 commit 7db1afd
Showing 1 changed file with 3 additions and 5 deletions.
8 changes: 3 additions & 5 deletions ares_getsock.c
Expand Up @@ -30,17 +30,15 @@ int ares_getsock(ares_channel channel,
/* Are there any active queries? */
int active_queries = !ares__is_list_empty(&(channel->all_queries));

for (i = 0;
(i < channel->nservers) && (sockindex < ARES_GETSOCK_MAXNUM);
i++)
for (i = 0; i < channel->nservers; i++)
{
server = &channel->servers[i];
/* We only need to register interest in UDP sockets if we have
* outstanding queries.
*/
if (active_queries && server->udp_socket != ARES_SOCKET_BAD)
{
if(sockindex >= numsocks)
if(sockindex >= numsocks || sockindex >= ARES_GETSOCK_MAXNUM)
break;
socks[sockindex] = server->udp_socket;
bitmap |= ARES_GETSOCK_READABLE(setbits, sockindex);
Expand All @@ -52,7 +50,7 @@ int ares_getsock(ares_channel channel,
*/
if (server->tcp_socket != ARES_SOCKET_BAD)
{
if(sockindex >= numsocks)
if(sockindex >= numsocks || sockindex >= ARES_GETSOCK_MAXNUM)
break;
socks[sockindex] = server->tcp_socket;
bitmap |= ARES_GETSOCK_READABLE(setbits, sockindex);
Expand Down

0 comments on commit 7db1afd

Please sign in to comment.