commit aa26b275034c07784c4d64e9a2bc26c742577327
author Charles-François Natali <neologix@free.fr> Sun Aug 28 17:51:43 2011 +0200
committer Charles-François Natali <neologix@free.fr> Sun Aug 28 17:51:43 2011 +0200
tree d331c0e5f2dd0fc0f754ffebaf9ebb9e5c4f7958
parent 524148ad7a3e5420abf867b1e30017b5ca2311a4

Issue #12287: Fix a stack corruption in ossaudiodev module when the FD is
greater than FD_SETSIZE.

Modules/ossaudiodev.c

diff --git a/Modules/ossaudiodev.c b/Modules/ossaudiodev.c
index e660e50..cdf6beb 100644
--- a/Modules/ossaudiodev.c
+++ b/Modules/ossaudiodev.c
@@ -425,6 +425,11 @@
     if (!PyArg_ParseTuple(args, "y#:write", &cp, &size))
         return NULL;
 
+    if (!_PyIsSelectable_fd(self->fd)) {
+        PyErr_SetString(PyExc_ValueError,
+                        "file descriptor out of range for select");
+        return NULL;
+    }
     /* use select to wait for audio device to be available */
     FD_ZERO(&write_set_fds);
     FD_SET(self->fd, &write_set_fds);