From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 25634 invoked by alias); 9 Aug 2012 16:27:50 -0000 Received: (qmail 25625 invoked by uid 22791); 9 Aug 2012 16:27:49 -0000 X-SWARE-Spam-Status: No, hits=-2.8 required=5.0 tests=AWL,BAYES_00,KHOP_THREADED,T_RP_MATCHES_RCVD X-Spam-Check-By: sourceware.org Received: from hagrid.ecoscentric.com (HELO mail.ecoscentric.com) (212.13.207.197) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Thu, 09 Aug 2012 16:27:36 +0000 Received: by mail.ecoscentric.com (Postfix, from userid 48) id 17A042F78005; Thu, 9 Aug 2012 17:27:34 +0100 (BST) From: bugzilla-daemon@bugs.ecos.sourceware.org To: unassigned@bugs.ecos.sourceware.org Subject: [Bug 1001522] Array index out of bounds in tftp_server.c X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: eCos X-Bugzilla-Component: TCP/IP X-Bugzilla-Keywords: X-Bugzilla-Severity: minor X-Bugzilla-Who: grant.b.edwards@gmail.com X-Bugzilla-Status: NEW X-Bugzilla-Priority: low X-Bugzilla-Assigned-To: unassigned@bugs.ecos.sourceware.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Changed-Fields: In-Reply-To: References: X-Bugzilla-URL: http://bugs.ecos.sourceware.org/ Auto-Submitted: auto-generated Content-Type: text/plain; charset="UTF-8" MIME-Version: 1.0 Date: Thu, 09 Aug 2012 16:27:00 -0000 Message-Id: <20120809162727.DB6362F78005@mail.ecoscentric.com> Mailing-List: contact ecos-bugs-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Post: List-Help: , Sender: ecos-bugs-owner@sourceware.org X-SW-Source: 2012/txt/msg01153.txt.bz2 Please do not reply to this email. Use the web interface provided at: http://bugs.ecos.sourceware.org/show_bug.cgi?id=1001522 --- Comment #10 from Grant Edwards 2012-08-09 17:27:25 BST --- (In reply to comment #9) > one other thing with the code is this: a valid socket handle is a > number >= 0. > > if (server->s[i]) { > FD_SET(server->s[i],&readfds); > > what if socket returns 0, because we have not stdio, i.e. inside a > daemon? You're right. There isn't any stdin/stdout/stderr or any concept of a daemon in eCos, and 0 is a perfectly valid value for a socket file descriptor. FWIW: in Unix, daemons do have stdin/stdout/stderr (descriptors 0,1,2) but they're usually connected to /dev/null. > should'nt it be like this: > if (server->s[i]>=0) { > FD_SET(server->s[i],&readfds); > > and > > if (server->s[i]>=0) { > close (server->s[i]); > server->s[i] = -1; > } Yes, you're correct. Using 0 as a "none" sentinal value for a socket/file descriptor is a bug. It's not an unusual mistake to make, and for Unix programs it's never detected because stdin is (almost) always fd 0, but I tripped over the same thing in some other eCos code I wrote years ago. Want to submit a patch? -- Configure bugmail: http://bugs.ecos.sourceware.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug.