die if fd_set overrun

kame · Aug 20, 2002 · 4d27c74 · 4d27c74
1 parent 3401223
commit 4d27c74
Show file tree

Hide file tree

Showing 3 changed files with 41 additions and 3 deletions.
diff --git a/kame/kame/faithd/faithd.c b/kame/kame/faithd/faithd.c
@@ -1,4 +1,4 @@
-/*	$KAME: faithd.c,v 1.56 2002/06/25 07:13:58 itojun Exp $	*/
+/*	$KAME: faithd.c,v 1.57 2002/08/20 23:01:00 itojun Exp $	*/
 
 /*
  * Copyright (C) 1997 and 1998 WIDE Project.
@@ -361,10 +361,14 @@ play_service(int s_wld)
 	setproctitle("%s", procname);
 
 	FD_ZERO(&rfds);
+	if (s_wld >= FD_SETSIZE)
+		exit_failure("descriptor too big");
 	FD_SET(s_wld, &rfds);
 	maxfd = s_wld;
 #ifdef USE_ROUTE
 	if (sockfd) {
+		if (sockfd >= FD_SETSIZE)
+			exit_failure("descriptor too big");
 		FD_SET(sockfd, &rfds);
 		maxfd = (maxfd < sockfd) ? sockfd : maxfd;
 	}

diff --git a/kame/kame/faithd/ftp.c b/kame/kame/faithd/ftp.c
@@ -1,4 +1,4 @@
-/*	$KAME: ftp.c,v 1.18 2002/06/23 14:41:47 itojun Exp $	*/
+/*	$KAME: ftp.c,v 1.19 2002/08/20 23:01:01 itojun Exp $	*/
 
 /*
  * Copyright (C) 1997 and 1998 WIDE Project.
@@ -82,24 +82,36 @@ ftp_relay(int ctl6, int ctl4)
 		int maxfd = 0;
 
 		FD_ZERO(&readfds);
+		if (ctl4 >= FD_SETSIZE)
+			exit_failure("descriptor too big");
 		FD_SET(ctl4, &readfds);
 		maxfd = ctl4;
+		if (ctl6 >= FD_SETSIZE)
+			exit_failure("descriptor too big");
 		FD_SET(ctl6, &readfds);
 		maxfd = (ctl6 > maxfd) ? ctl6 : maxfd;
 		if (0 <= port4) {
+			if (port4 >= FD_SETSIZE)
+				exit_failure("descriptor too big");
 			FD_SET(port4, &readfds);
 			maxfd = (port4 > maxfd) ? port4 : maxfd;
 		}
 		if (0 <= port6) {
+			if (port6 >= FD_SETSIZE)
+				exit_failure("descriptor too big");
 			FD_SET(port6, &readfds);
 			maxfd = (port6 > maxfd) ? port6 : maxfd;
 		}
 #if 0
 		if (0 <= wport4) {
+			if (wport4 >= FD_SETSIZE)
+				exit_failure("descriptor too big");
 			FD_SET(wport4, &readfds);
 			maxfd = (wport4 > maxfd) ? wport4 : maxfd;
 		}
 		if (0 <= wport6) {
+			if (wport6 >= FD_SETSIZE)
+				exit_failure("descriptor too big");
 			FD_SET(wport6, &readfds);
 			maxfd = (wport6 > maxfd) ? wport6 : maxfd;
 		}
@@ -222,6 +234,8 @@ ftp_activeconn()
 
 	/* get active connection from server */
 	FD_ZERO(&set);
+	if (wport4 >= FD_SETSIZE)
+		exit_failure("descriptor too big");
 	FD_SET(wport4, &set);
 	timeout.tv_sec = 120;
 	timeout.tv_usec = -1;
@@ -269,6 +283,8 @@ ftp_passiveconn()
 
 	/* get passive connection from client */
 	FD_ZERO(&set);
+	if (wport6 >= FD_SETSIZE)
+		exit_failure("descriptor too big");
 	FD_SET(wport6, &set);
 	timeout.tv_sec = 120;
 	timeout.tv_usec = 0;

diff --git a/kame/kame/faithd/tcp.c b/kame/kame/faithd/tcp.c
@@ -1,4 +1,4 @@
-/*	$KAME: tcp.c,v 1.9 2002/05/26 01:17:02 itojun Exp $	*/
+/*	$KAME: tcp.c,v 1.10 2002/08/20 23:01:01 itojun Exp $	*/
 
 /*
  * Copyright (C) 1997 and 1998 WIDE Project.
@@ -155,6 +155,8 @@ send_data(int s_rcv, int s_snd, const char *service, int direction)
 		if (cc == -1)
 			goto retry_or_err;
 		oob_exists = 0;
+		if (s_rcv >= FD_SETSIZE)
+			exit_failure("descriptor too big");
 		FD_SET(s_rcv, &exceptfds);
 	}
 
@@ -173,12 +175,18 @@ send_data(int s_rcv, int s_snd, const char *service, int direction)
 	}
 #endif /* DEBUG */
 	tblen = 0; tboff = 0;
+	if (s_snd >= FD_SETSIZE)
+		exit_failure("descriptor too big");
 	FD_CLR(s_snd, &writefds);
+	if (s_rcv >= FD_SETSIZE)
+		exit_failure("descriptor too big");
 	FD_SET(s_rcv, &readfds);
 	return;
     retry_or_err:
 	if (errno != EAGAIN)
 		exit_failure("writing relay data failed: %s", strerror(errno));
+	if (s_snd >= FD_SETSIZE)
+		exit_failure("descriptor too big");
 	FD_SET(s_snd, &writefds);
 }
 
@@ -194,6 +202,8 @@ relay(int s_rcv, int s_snd, const char *service, int direction)
 	FD_ZERO(&exceptfds);
 	fcntl(s_snd, F_SETFD, O_NONBLOCK);
 	oreadfds = readfds; owritefds = writefds; oexceptfds = exceptfds;
+	if (s_rcv >= FD_SETSIZE)
+		exit_failure("descriptor too big");
 	FD_SET(s_rcv, &readfds);
 	FD_SET(s_rcv, &exceptfds);
 	oob_exists = 0;
@@ -228,7 +238,11 @@ relay(int s_rcv, int s_snd, const char *service, int direction)
 			    oob_read_retry:
 				cc = read(s_rcv, atmark_buf, 1);
 				if (cc == 1) {
+					if (s_rcv >= FD_SETSIZE)
+						exit_failure("descriptor too big");
 					FD_CLR(s_rcv, &exceptfds);
+					if (s_snd >= FD_SETSIZE)
+						exit_failure("descriptor too big");
 					FD_SET(s_snd, &writefds);
 					oob_exists = 1;
 				} else if (cc == -1) {
@@ -261,7 +275,11 @@ relay(int s_rcv, int s_snd, const char *service, int direction)
 				exit_success("terminating %s relay", service);
 				/* NOTREACHED */
 			default:
+				if (s_rcv >= FD_SETSIZE)
+					exit_failure("descriptor too big");
 				FD_CLR(s_rcv, &readfds);
+				if (s_snd >= FD_SETSIZE)
+					exit_failure("descriptor too big");
 				FD_SET(s_snd, &writefds);
 				break;
 			}