[sctp] validate fd before assignment and usage

Signed-off-by: Fabio M. Di Nitto <fdinitto@redhat.com>
kronosnet · Jul 18, 2019 · 0c53189 · 0c53189
1 parent 723b9ae
commit 0c53189
Showing 1 changed file with 10 additions and 6 deletions.
diff --git a/libknet/transport_sctp.c b/libknet/transport_sctp.c
@@ -601,20 +601,22 @@ static void _handle_connected_sctp(knet_handle_t knet_h, int connect_sock)
 
 static void _handle_connected_sctp_errors(knet_handle_t knet_h)
 {
-	int sockfd = -1;
+	int sockfd = 0, infd = -1;
 	sctp_handle_info_t *handle_info = knet_h->transports[KNET_TRANSPORT_SCTP];
 	sctp_connect_link_info_t *info;
 
-	if (recv(handle_info->connectsockfd[0], &sockfd, sizeof(int), MSG_DONTWAIT | MSG_NOSIGNAL) != sizeof(int)) {
+	if (recv(handle_info->connectsockfd[0], &infd, sizeof(int), MSG_DONTWAIT | MSG_NOSIGNAL) != sizeof(int)) {
 		log_debug(knet_h, KNET_SUB_TRANSP_SCTP, "Short read on connectsockfd");
 		return;
 	}
 
-	if (_is_valid_fd(knet_h, sockfd) < 1) {
+	if (_is_valid_fd(knet_h, infd) < 1) {
 		log_debug(knet_h, KNET_SUB_TRANSP_SCTP, "Received stray notification for connected socket fd error");
 		return;
 	}
 
+	sockfd = infd;
+
 	log_debug(knet_h, KNET_SUB_TRANSP_SCTP, "Processing connected error on socket: %d", sockfd);
 
 	info = knet_h->knet_transport_fd_tracker[sockfd].data;
@@ -825,24 +827,26 @@ static void _handle_incoming_sctp(knet_handle_t knet_h, int listen_sock)
  */
 static void _handle_listen_sctp_errors(knet_handle_t knet_h)
 {
-	int sockfd = -1;
+	int sockfd = 0, infd = -1;
 	sctp_handle_info_t *handle_info = knet_h->transports[KNET_TRANSPORT_SCTP];
 	sctp_accepted_link_info_t *accept_info;
 	sctp_listen_link_info_t *info;
 	struct knet_host *host;
 	int link_idx;
 	int i;
 
-	if (recv(handle_info->listensockfd[0], &sockfd, sizeof(int), MSG_DONTWAIT | MSG_NOSIGNAL) != sizeof(int)) {
+	if (recv(handle_info->listensockfd[0], &infd, sizeof(int), MSG_DONTWAIT | MSG_NOSIGNAL) != sizeof(int)) {
 		log_debug(knet_h, KNET_SUB_TRANSP_SCTP, "Short read on listensockfd");
 		return;
 	}
 
-	if (_is_valid_fd(knet_h, sockfd) < 1) {
+	if (_is_valid_fd(knet_h, infd) < 1) {
 		log_debug(knet_h, KNET_SUB_TRANSP_SCTP, "Received stray notification for listen socket fd error");
 		return;
 	}
 
+	sockfd = infd;
+
 	log_debug(knet_h, KNET_SUB_TRANSP_SCTP, "Processing listen error on socket: %d", sockfd);
 
 	accept_info = knet_h->knet_transport_fd_tracker[sockfd].data;