PATCH: zselect: don't pass fd>=FD_SETSIZE to FD_SET

Mikael Magnusson <[email protected]>
Newsgroups gmane.comp.shells.zsh.devel
Message-ID <[email protected]>
zsh% zselect 2023
==2815== Syscall param select(exceptfds) points to uninitialised byte(s)
==2815==    at 0x4DDA2D6: select (in /lib64/libc-2.32.so)
==2815==    by 0x4885937: bin_zselect (zselect.c:175)
==2815==    by 0x410C5E: execbuiltin (builtin.c:506)
==2815==    by 0x43A5FC: execcmd_exec (exec.c:4259)
==2815==    by 0x433BE1: execpline2 (exec.c:2040)
==2815==    by 0x432824: execpline (exec.c:1765)
==2815==    by 0x431A7D: execlist (exec.c:1515)
==2815==    by 0x4310E3: execode (exec.c:1296)
==2815==    by 0x457D15: loop (init.c:223)
==2815==    by 0x45C151: zsh_main (init.c:1933)
==2815==    by 0x40FD61: main (main.c:93)
==2815==  Address 0x1ffeffe5b0 is on thread 1's stack
==2815==  in frame #1, created by bin_zselect (zselect.c:66)
zselect: error on select: bad file descriptor
---
 Src/Modules/zselect.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Src/Modules/zselect.c b/Src/Modules/zselect.c
index 8c12672407..92a3b38c24 100644
--- a/Src/Modules/zselect.c
+++ b/Src/Modules/zselect.c
@@ -47,6 +47,10 @@ handle_digits(char *nam, char *argptr, fd_set *fdset, int *fdmax)
 	return 1;
     }
     fd = (int)zstrtol(argptr, &endptr, 10);
+    if (fd < 0 || fd >= FD_SETSIZE) {
+	zwarnnam(nam, "file descriptor out of range [0-%d]: %d", FD_SETSIZE-1, fd);
+	return 1;
+    }
     if (*endptr) {
 	zwarnnam(nam, "garbage after file descriptor: %s", endptr);
 	return 1;
-- 
2.38.1
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.