Skip to content

Commit

Permalink
Fix a possible overflow due to use of fionread in poll_oneoff on Unix.
Browse files Browse the repository at this point in the history
  • Loading branch information
marmistrz committed Jan 31, 2020
1 parent f2fa484 commit b2bedca
Showing 1 changed file with 13 additions and 1 deletion.
14 changes: 13 additions & 1 deletion crates/wasi-common/src/sys/unix/hostcalls_impl/misc.rs
Original file line number Diff line number Diff line change
Expand Up @@ -126,9 +126,21 @@ fn poll_oneoff_handle_fd_event<'a>(
ready_events: impl Iterator<Item = (FdEventData<'a>, yanix::poll::PollFd)>,
events: &mut Vec<wasi::__wasi_event_t>,
) -> Result<()> {
use crate::fdentry::Descriptor;
use std::{convert::TryInto, os::unix::prelude::AsRawFd};
use yanix::{file::fionread, poll::PollFlags};

fn query_nbytes(fd: &Descriptor) -> Result<usize> {
// fionread may overflow for large files, so use another way for regular files.
if let Descriptor::OsHandle(os_handle) = fd {
let meta = os_handle.metadata()?;
if meta.file_type().is_file() {
return meta.len().try_into().map_err(Into::into);
}
}
unsafe { fionread(fd.as_raw_fd()) }.map_err(Into::into)
}

for (fd_event, poll_fd) in ready_events {
log::debug!("poll_oneoff_handle_fd_event fd_event = {:?}", fd_event);
log::debug!("poll_oneoff_handle_fd_event poll_fd = {:?}", poll_fd);
Expand All @@ -141,7 +153,7 @@ fn poll_oneoff_handle_fd_event<'a>(
log::debug!("poll_oneoff_handle_fd_event revents = {:?}", revents);

let nbytes = if fd_event.r#type == wasi::__WASI_EVENTTYPE_FD_READ {
unsafe { fionread(fd_event.descriptor.as_raw_fd())? }
query_nbytes(fd_event.descriptor)?
} else {
0
};
Expand Down

0 comments on commit b2bedca

Please sign in to comment.