From owner-freebsd-current@FreeBSD.ORG Mon Jun 9 02:23:02 2003 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3E5AE37B401; Mon, 9 Jun 2003 02:23:02 -0700 (PDT) Received: from mailout11.sul.t-online.com (mailout11.sul.t-online.com [194.25.134.85]) by mx1.FreeBSD.org (Postfix) with ESMTP id 01A9143F75; Mon, 9 Jun 2003 02:23:01 -0700 (PDT) (envelope-from Alexander@Leidinger.net) Received: from fwd00.aul.t-online.de by mailout11.sul.t-online.com with smtp id 19PIrf-0003Ng-00; Mon, 09 Jun 2003 11:22:55 +0200 Received: from Andro-Beta.Leidinger.net (rPTUkOZYQeFN-3YuR5SZxGiG1sNjYqUBojSrzzE9jaWXxY+kRkYV65@[80.131.127.114]) by fmrl00.sul.t-online.com with esmtp id 19PIrY-2Fyzc80; Mon, 9 Jun 2003 11:22:48 +0200 Received: from Magelan.Leidinger.net (Magelan [192.168.1.1]) h599MjoM053861; Mon, 9 Jun 2003 11:22:45 +0200 (CEST) (envelope-from Alexander@Leidinger.net) Received: from Magelan.Leidinger.net (netchild@localhost [127.0.0.1]) by Magelan.Leidinger.net (8.12.9/8.12.9) with SMTP id h599MjmQ001421; Mon, 9 Jun 2003 11:22:45 +0200 (CEST) (envelope-from Alexander@Leidinger.net) Date: Mon, 9 Jun 2003 11:22:45 +0200 From: Alexander Leidinger To: ted@NLnetLabs.nl (Ted Lindgreen) Message-Id: <20030609112245.573a7e5f.Alexander@Leidinger.net> In-Reply-To: <200306090828.h598SYqI008965@open.nlnetlabs.nl> References: <200306090828.h598SYqI008965@open.nlnetlabs.nl> X-Mailer: Sylpheed version 0.8.10claws (GTK+ 1.2.10; i386-portbld-freebsd5.0) Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="Multipart_Mon__9_Jun_2003_11:22:45_+0200_08f03e00" X-Seen: false X-ID: rPTUkOZYQeFN-3YuR5SZxGiG1sNjYqUBojSrzzE9jaWXxY+kRkYV65@t-dialin.net cc: ports@freebsd.org cc: deischen@freebsd.org cc: freebsd-current@freebsd.org cc: avleeuwen@piwebs.com cc: rwatson@freebsd.org cc: lioux@freebsd.org Subject: Re: Re Regression: Playing QT files from mplayer stopped working in 5.1 X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: netchild@FreeBSD.org List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Jun 2003 09:23:02 -0000 This is a multi-part message in MIME format. --Multipart_Mon__9_Jun_2003_11:22:45_+0200_08f03e00 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Mon, 9 Jun 2003 10:28:33 +0200 ted@NLnetLabs.nl (Ted Lindgreen) wrote: > However, I guess that mplayer has had this error already, but that > a change in uthread_close.c as of May 31 has caused this problem > to show up now. > In particular: the unprotected usage of a very large value of "fd" > in "_thread_fd_table[fd]" leads to the segmentation violation. > > Previously the systemcall just returned an error without getting > into a segmentation violation. > Question: > shouldn't _close in uthread_close.c do some sanity check on "fd" > before using it as an array index? Try the attached patch. Bye, Alexander. -- Intel: where Quality is job number 0.9998782345! http://www.Leidinger.net Alexander @ Leidinger.net GPG fingerprint = C518 BC70 E67F 143F BE91 3365 79E2 9C60 B006 3FE7 --Multipart_Mon__9_Jun_2003_11:22:45_+0200_08f03e00 Content-Type: text/plain; name="uthread_close.diff" Content-Disposition: attachment; filename="uthread_close.diff" Content-Transfer-Encoding: 8bit Index: lib/libc_r/uthread/uthread_close.c =================================================================== RCS file: /big/FreeBSD-CVS/src/lib/libc_r/uthread/uthread_close.c,v retrieving revision 1.15 diff -u -r1.15 uthread_close.c --- lib/libc_r/uthread/uthread_close.c 31 May 2003 05:23:20 -0000 1.15 +++ lib/libc_r/uthread/uthread_close.c 9 Jun 2003 09:18:50 -0000 @@ -49,7 +49,8 @@ struct stat sb; struct fd_table_entry *entry; - if ((fd == _thread_kern_pipe[0]) || (fd == _thread_kern_pipe[1]) || + if ((fd < 0) || (fd >= _thread_dtablesize) || + (fd == _thread_kern_pipe[0]) || (fd == _thread_kern_pipe[1]) || (_thread_fd_table[fd] == NULL)) { /* * Don't allow silly programs to close the kernel pipe --Multipart_Mon__9_Jun_2003_11:22:45_+0200_08f03e00--