| commit | 025f1082b6c9573772472cc9039c2e10225c2c42 | [log] [tgz] |
|---|---|---|
| author | Dr. David Alan Gilbert <dave@treblig.org> | Tue Nov 05 11:54:51 2013 +0100 |
| committer | Denys Vlasenko <dvlasenk@redhat.com> | Tue Nov 05 11:54:51 2013 +0100 |
| tree | ab275532c13c67dcc7d430be1c9810820b5a64f2 | |
| parent | 0b4060f61f1bb101b5d8d084714b7d2feacdb199 [diff] |
Fix select decoding with bogus (huge or negative) nfds. We used to allocate and fetch bit arrays using a sanitized length, but then iterate over them with "j < arg[0]" condition, where arg[0] is not sanitized. This segfaults if arg[0] is huge or negative. This change fixes this. Add test/select.c to capture the case. Signed-off-by: Dr. David Alan Gilbert <dave@treblig.org> Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>