Attachment 1319079 Details for Bug 1464409 – Fix memory corruption caused by accessing array with negative index

[patch] Fix memory corruption caused by accessing array with negative index

ksh-20120801-sh_iovalidfd.patch (text/plain), 2.21 KB, created by Siteshwar Vashisht on 2017-08-28 13:18:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Siteshwar Vashisht

Created: 2017-08-28 13:18:34 UTC

Size: 2.21 KB

patch

obsolete

>diff --git a/src/cmd/ksh93/include/io.h b/src/cmd/ksh93/include/io.h
>--- a/src/cmd/ksh93/include/io.h
>+++ b/src/cmd/ksh93/include/io.h
>@@ -79,7 +79,7 @@ extern Sfio_t 	*sh_iostream(Shell_t*,int);
> extern int	sh_redirect(Shell_t*,struct ionod*,int);
> extern void 	sh_iosave(Shell_t *, int,int,char*);
> extern int 	safefdnumber(Shell_t* shp, int sfd);
>-extern int 	sh_iovalidfd(Shell_t*, int);
>+extern bool 	sh_iovalidfd(Shell_t*, int);
> extern int 	sh_inuse(Shell_t*, int);
> extern void 	sh_iounsave(Shell_t*);
> extern void	iounpipe(Shell_t*);
>diff --git a/src/cmd/ksh93/sh/io.c b/src/cmd/ksh93/sh/io.c
>--- a/src/cmd/ksh93/sh/io.c
>+++ b/src/cmd/ksh93/sh/io.c
>@@ -403,38 +403,50 @@ static short		filemapsize;
> 
> /* ======== input output and file copying ======== */
> 
>-int  sh_iovalidfd(Shell_t *shp, int fd)
>+bool  sh_iovalidfd(Shell_t *shp, int fd)
> {
> 	Sfio_t		**sftable = shp->sftable;
> 	int		max,n, **fdptrs = shp->fdptrs;
>-	unsigned char	*fdstatus = shp->fdstatus;
>+	unsigned int	*fdstatus = shp->fdstatus;
> 	if(fd<0)
>-		return(0);
>+		return(false);
> 	if(fd < shp->gd->lim.open_max)
>-		return(1);
>+		return(true);
> 	max = strtol(astconf("OPEN_MAX",NiL,NiL),NiL,0);
> 	if(fd >= max)
> 	{
> 		errno = EBADF;
>-		return(0);
>+		return(false);
> 	}
> 	n = (fd+16)&~0xf;
>-	if(n > max)
>-		n = max;
>+	if(n++ > max)
>+		n = max+1;
> 	max = shp->gd->lim.open_max;
>-	shp->sftable = (Sfio_t**)calloc((n+1)*(sizeof(int*)+sizeof(Sfio_t*)+1),1);
>-	if(max)
>-		memcpy(shp->sftable,sftable,max*sizeof(Sfio_t*));
>+	shp->sftable = (Sfio_t**)calloc((n+1)*(sizeof(int*)+sizeof(Sfio_t*)+sizeof(*fdstatus)),1);
>+
>+	if(sftable)
>+	{
>+		--sftable;
>+		if(max)
>+			memcpy(shp->sftable,sftable,++max*sizeof(Sfio_t*));
>+
>+	}
>+
> 	shp->fdptrs = (int**)(&shp->sftable[n]);
> 	if(max)
>-		memcpy(shp->fdptrs,fdptrs,max*sizeof(int*));
>-	shp->fdstatus = (unsigned char*)(&shp->fdptrs[n]);
>+		memcpy(shp->fdptrs,--fdptrs,max*sizeof(int*));
>+	shp->fdstatus = (unsigned int*)(&shp->fdptrs[n]);
> 	if(max)
>-		memcpy(shp->fdstatus,fdstatus,max);
>+		memcpy(shp->fdstatus,--fdstatus,max);
>+
> 	if(sftable)
> 		free((void*)sftable);
>-	shp->gd->lim.open_max = n;
>-	return(1);
>+
>+	shp->sftable++;
>+	shp->fdptrs++;
>+	shp->fdstatus++;
>+	shp->gd->lim.open_max = n-1;
>+	return(true);
> }
> 
> int  sh_inuse(Shell_t *shp, int fd)

Flags:

kdudka: review-

Actions: View | Diff

Attachments on bug 1464409: 1319079 | 1319143