Date: Mon, 9 Jun 2003 11:22:45 +0200 From: Alexander Leidinger <Alexander@Leidinger.net> To: ted@NLnetLabs.nl (Ted Lindgreen) Cc: lioux@freebsd.org Subject: Re: Re Regression: Playing QT files from mplayer stopped working in 5.1 Message-ID: <20030609112245.573a7e5f.Alexander@Leidinger.net> In-Reply-To: <200306090828.h598SYqI008965@open.nlnetlabs.nl> References: <200306090828.h598SYqI008965@open.nlnetlabs.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format.
--Multipart_Mon__9_Jun_2003_11:22:45_+0200_08f03e00
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
On Mon, 9 Jun 2003 10:28:33 +0200
ted@NLnetLabs.nl (Ted Lindgreen) wrote:
> However, I guess that mplayer has had this error already, but that
> a change in uthread_close.c as of May 31 has caused this problem
> to show up now.
> In particular: the unprotected usage of a very large value of "fd"
> in "_thread_fd_table[fd]" leads to the segmentation violation.
>
> Previously the systemcall just returned an error without getting
> into a segmentation violation.
> Question:
> shouldn't _close in uthread_close.c do some sanity check on "fd"
> before using it as an array index?
Try the attached patch.
Bye,
Alexander.
--
Intel: where Quality is job number 0.9998782345!
http://www.Leidinger.net Alexander @ Leidinger.net
GPG fingerprint = C518 BC70 E67F 143F BE91 3365 79E2 9C60 B006 3FE7
--Multipart_Mon__9_Jun_2003_11:22:45_+0200_08f03e00
Content-Type: text/plain;
name="uthread_close.diff"
Content-Disposition: attachment;
filename="uthread_close.diff"
Content-Transfer-Encoding: 8bit
Index: lib/libc_r/uthread/uthread_close.c
===================================================================
RCS file: /big/FreeBSD-CVS/src/lib/libc_r/uthread/uthread_close.c,v
retrieving revision 1.15
diff -u -r1.15 uthread_close.c
--- lib/libc_r/uthread/uthread_close.c 31 May 2003 05:23:20 -0000 1.15
+++ lib/libc_r/uthread/uthread_close.c 9 Jun 2003 09:18:50 -0000
@@ -49,7 +49,8 @@
struct stat sb;
struct fd_table_entry *entry;
- if ((fd == _thread_kern_pipe[0]) || (fd == _thread_kern_pipe[1]) ||
+ if ((fd < 0) || (fd >= _thread_dtablesize) ||
+ (fd == _thread_kern_pipe[0]) || (fd == _thread_kern_pipe[1]) ||
(_thread_fd_table[fd] == NULL)) {
/*
* Don't allow silly programs to close the kernel pipe
--Multipart_Mon__9_Jun_2003_11:22:45_+0200_08f03e00--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030609112245.573a7e5f.Alexander>