Bug 2026289

> Description of problem:
Crond eats memory and runs into segfault at last if getdtablesize() returns a huge value.

> Version-Release number of selected component (if applicable):
cronie-1.4.11-23.el7.x86_64

> How reproducible:
Frequently

> Steps to Reproduce:
1. On RHEL7.9
2. Set the nofile to 2147483584:

$ cat etc/security/limits.conf | grep nof | grep myuser
myuser            soft    nofile         2147483584
myuser            hard    nofile         2147483584

3. Set cron job with 'myuser'

> Actual results:
Crond runs into segfault from time to time.

> Expected results:
No segfault.

> Additional info:
Upstream fix can prevent allocating lots of memory:
-------------8< -------------8< -------------8< -------------
commit 584911514ce6aa2f16e1d79431bac816ea62cb2c
Author: Tomas Mraz <tmraz>
Date:   Mon Jul 8 10:57:52 2019 +0200

    getdtablesize() can return very high values in containers
    
    Avoid closing hundreds of millions descriptors or allocating
    huge arrays by maxing the fd number to MAX_CLOSE_FD.
    See rhbz#1723106

...
 /*
  * Because crontab/at files may be owned by their respective users we
  * take extreme care in opening them.  If the OS lacks the O_NOFOLLOW
diff --git a/src/popen.c b/src/popen.c
index badddb6..4397264 100644
--- a/src/popen.c
+++ b/src/popen.c
@@ -81,12 +81,19 @@ FILE *cron_popen(char *program, const char *type, struct passwd *pw, char **jobe
        if (!pids) {
                if ((fds = getdtablesize()) <= 0)
                        return (NULL);
+               if (fds > MAX_CLOSE_FD)
+                       fds = MAX_CLOSE_FD; /* avoid allocating too much memory */
                if (!(pids = (PID_T *) malloc((u_int) ((size_t)fds * sizeof (PID_T)))))
                        return (NULL);
                memset((char *) pids, 0, (size_t)fds * sizeof (PID_T));
        }
        if (pipe(pdes) < 0)
                return (NULL);
...
-------------8< -------------8< -------------8< -------------