Skip to content
This repository was archived by the owner on Apr 22, 2023. It is now read-only.

Commit 2fdeb7e

Browse files
oleavrtrevnorris
authored andcommitted
uv: fix size calculation in select() fallback
Original commit message: darwin: fix size calculation in select() fallback Apple's `fd_set` stores its bits in an array of 32-bit integers, which means `FD_ISSET()` may read out of bounds if we allocate storage at byte granularity. There's also a chance that the `select()` call could corrupt the heap, although I didn't investigate that. This issue was discovered by LLVM's AddressSanitizer which caught `FD_ISSET()` trying to read out of bounds. Ref: libuv/libuv#241 Reviewed-By: Julien Gilli <julien.gilli@joyent.com> PR-URL: #9179
1 parent 9613ac7 commit 2fdeb7e

File tree

2 files changed

+4
-1
lines changed

2 files changed

+4
-1
lines changed

deps/uv/src/unix/internal.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,9 @@
5555
#define ACCESS_ONCE(type, var) \
5656
(*(volatile type*) &(var))
5757

58+
#define ROUND_UP(a, b) \
59+
((a) % (b) ? ((a) + (b)) - ((a) % (b)) : (a))
60+
5861
#define UNREACHABLE() \
5962
do { \
6063
assert(0 && "unreachable code"); \

deps/uv/src/unix/stream.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -301,7 +301,7 @@ int uv__stream_try_select(uv_stream_t* stream, int* fd) {
301301
if (fds[1] > max_fd)
302302
max_fd = fds[1];
303303

304-
sread_sz = (max_fd + NBBY) / NBBY;
304+
sread_sz = ROUND_UP(max_fd + 1, sizeof(uint32_t) * NBBY) / NBBY;
305305
swrite_sz = sread_sz;
306306

307307
s = malloc(sizeof(*s) + sread_sz + swrite_sz);

0 commit comments

Comments
 (0)