From def133f26fec9ef1937f16ac02ef3641e07a4bef Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Wed, 28 Dec 2016 12:16:01 +0100 Subject: [PATCH] Check that fd_set has not fds bigger than FD_SETSIZE * src/connect.c: check that the fd is not bigger than FD_SETSIZE before using FD_SET. An fd_set cannot hold fds bigger than FD_SETSIZE, causing out-of-bounds write to a buffer on the stack. Reported by: Jann Horn --- src/connect.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/connect.c b/src/connect.c index e41f1484..7e181716 100644 --- a/src/connect.c +++ b/src/connect.c @@ -31,6 +31,7 @@ as that of the covered work. */ #include "wget.h" +#include "exits.h" #include #include #include @@ -693,6 +694,11 @@ select_fd (int fd, double maxtime, int wait_for) struct timeval tmout; int result; + if (fd >= FD_SETSIZE) + { + logprintf (LOG_NOTQUIET, _("Too many fds open. Cannot use select on a fd >= %d\n"), FD_SETSIZE); + exit (WGET_EXIT_GENERIC_ERROR); + } FD_ZERO (&fdset); FD_SET (fd, &fdset); if (wait_for & WAIT_FOR_READ) @@ -735,6 +741,11 @@ test_socket_open (int sock) struct timeval to; int ret = 0; + if (sock >= FD_SETSIZE) + { + logprintf (LOG_NOTQUIET, _("Too many fds open. Cannot use select on a fd >= %d\n"), FD_SETSIZE); + exit (WGET_EXIT_GENERIC_ERROR); + } /* Check if we still have a valid (non-EOF) connection. From Andrew * Maholski's code in the Unix Socket FAQ. */