Re: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



David LeBlanc wrote:
if (__i == ((fd_set FAR *)(set))->fd_count) { \
if (((fd_set FAR *)(set))->fd_count < FD_SETSIZE) { \
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
((fd_set FAR *)(set))->fd_array[__i] = (fd); \
((fd_set FAR *)(set))->fd_count++; \
} \
} \
} while(0)


So if you attempted to put FD_SETSIZE + 1 sockets into an fd_set, it
would just fail.

This effectively limits select to a maximum of FD_SETSIZE descriptors on Windows. I don't think that this limitiation exists on other platforms.

Correctly written programs dynamically allocate their FD_SETs to avoid
these problems (or they use poll or some other mechanism instead).

-d

[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux