Skip to content

cfilters: fix Curl_pollset_poll() return code mixup#21231

Closed
bagder wants to merge 1 commit intomasterfrom
bagder/pollset-errors
Closed

cfilters: fix Curl_pollset_poll() return code mixup#21231
bagder wants to merge 1 commit intomasterfrom
bagder/pollset-errors

Conversation

@bagder
Copy link
Copy Markdown
Member

@bagder bagder commented Apr 5, 2026

Curl_conn_cf_poll did not map adjust_pollset failures to poll-style errors properly, so error codes were treated as ready events.

Found by Codex Security

Curl_conn_cf_poll did not map adjust_pollset failures to poll-style
errors properly, so error codes were treated as ready events.

Found by Codex Security
@bagder bagder requested review from Copilot and icing April 5, 2026 15:45
@bagder bagder marked this pull request as ready for review April 5, 2026 16:19
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes an error-code mapping issue in the connection-filter polling path: Curl_conn_cf_poll() previously mixed CURLcode return values with poll-style return codes, which could cause failures from adjust_pollset to be misinterpreted as “ready events”.

Changes:

  • Document poll-style return semantics for Curl_pollset_poll() and Curl_conn_cf_poll().
  • Fix Curl_conn_cf_poll() to return a poll-style int result and map adjust_pollset failures to -1.
  • Minor local variable cleanup/rename in Curl_pollset_poll().

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
lib/select.c Adds return-value documentation for Curl_pollset_poll() and renames local return variable.
lib/cfilters.c Fixes Curl_conn_cf_poll() return-code handling to avoid treating CURLcode failures as ready events.
Comments suppressed due to low confidence (1)

lib/select.c:668

  • The new return-value comment doesn’t match the actual behavior: this function can also return -1 when curlx_calloc() for pfds fails (OOM), not just on poll/select errors or fd >= FD_SETSIZE (handled inside Curl_poll()). Please either update the comment to include OOM (and/or clarify that errors include allocation failures), or change the function to set an appropriate socket errno before returning -1 for allocation failures so callers get consistent diagnostics.
/*
 * Return values:
 *   -1 = system call error or fd >= FD_SETSIZE
 *    0 = timeout
 *    N = number of structures with non zero revent fields
 */
int Curl_pollset_poll(struct Curl_easy *data,
                      struct easy_pollset *ps,
                      timediff_t timeout_ms)
{
  struct pollfd *pfds;
  unsigned int i, npfds;
  int rc;

  (void)data;
  DEBUGASSERT(data);
  DEBUGASSERT(data->conn);

  if(!ps->n)
    return curlx_wait_ms(timeout_ms);

  pfds = curlx_calloc(ps->n, sizeof(*pfds));
  if(!pfds)
    return -1;

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@bagder bagder closed this in 4cb4f9d Apr 6, 2026
@bagder bagder deleted the bagder/pollset-errors branch April 6, 2026 20:09
dkarpov1970 pushed a commit to dkarpov1970/curl that referenced this pull request Apr 7, 2026
Curl_conn_cf_poll did not map adjust_pollset failures to poll-style
errors properly, so error codes were treated as ready events.

Found by Codex Security

Closes curl#21231
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants