master: Check that fd-set/fd-clr don't overflow fd-setsize

The branch "master" has been updated in SBCL:
       via  b2dc86b47a1023856188d24c2c6e7cfe0eb12fac (commit)
      from  a80d44a4bc12107b2dac6045df16d2bb77e1a515 (commit)

- Log -----------------------------------------------------------------
commit b2dc86b47a1023856188d24c2c6e7cfe0eb12fac
Author: Stas Boukarev <[email protected]>
Date:   Wed Apr 15 17:43:31 2026 +0300

    Check that fd-set/fd-clr don't overflow fd-setsize
    
    Or they will write beyond the stack allocated struct.
---
 src/code/target-hash-table.lisp | 6 +++---
 src/code/unix.lisp              | 4 +++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/code/target-hash-table.lisp b/src/code/target-hash-table.lisp
index c08156bf6..be2a99bfc 100644
--- a/src/code/target-hash-table.lisp
+++ b/src/code/target-hash-table.lisp
@@ -406,7 +406,7 @@
 (defun expected-n-empty-buckets (n-keys n-buckets)
   (let ((b (coerce n-buckets 'double-float)))
     ;; https://www.randomservices.org/random/urn/Birthday.html states
-    ;; that the expected number of empy buckets ("excluded values") is
+    ;; that the expected number of empty buckets ("excluded values") is
     ;; (* B (EXPT (- 1 (/ B)) N-KEYS)). Here we compute a very tight
     ;; upper bound on that (its limit at infinite size), which is
     ;; slightly faster. Use %EXP because bound derivation for EXP
@@ -2022,7 +2022,7 @@ multiple threads accessing the same hash-table without locking."
             ;; pointer. In other words, even if the vector were considered a root,
             ;; it wouldn't matter from a heap consistency perspective because it would
             ;; not transitively enliven anything, but you can't stop people from using
-            ;; SVREF on it past the high water mark. To to make things safe,
+            ;; SVREF on it past the high water mark. To make things safe,
             ;; we sort of have to zero-fill.
             ;; Also fwiw, it would be necessary to fix verify_range() to understand
             ;; that it MUST NOT verify past the hwm, and similary the low-level debugger
@@ -2495,7 +2495,7 @@ nnnn 1_    any       linear scan (don't try to read when rehash already in progr
        ;; it's the other way around.
        (declare (type (or fixnum maybe-truncated-hash) hash0))
        (dx-flet ((body ()
-                   ;; Delaying the transfer of culled cells could causee the linked list
+                   ;; Delaying the transfer of culled cells could cause the linked list
                    ;; denoting the cells to itself be promoted into a higher generation.
                    ;; Ideally the list would be off-heap and not subject to GC. Attempting to
                    ;; do that would engender two other problems: (1) knowing when to free the list
diff --git a/src/code/unix.lisp b/src/code/unix.lisp
index c4f240f77..06fc530b0 100644
--- a/src/code/unix.lisp
+++ b/src/code/unix.lisp
@@ -707,7 +707,9 @@ avoiding atexit(3) hooks, etc. Otherwise exit(2) is called."
              (select (int-sap 0)))))))
 
 ;;; Lisp-side implementations of FD_FOO macros.
-(declaim (inline fd-set fd-clr fd-isset fd-zero))
+(declaim (inline fd-set fd-clr fd-isset fd-zero)
+         (ftype (function ((integer 0 (#.fd-setsize)) t))
+                fd-set fd-clr fd-isset))
 (defun fd-set (offset fd-set)
   (multiple-value-bind (word bit) (floor offset
                                             sb-vm:n-machine-word-bits)

-----------------------------------------------------------------------


hooks/post-receive
-- 
SBCL