QubesOS/qubes-core-admin-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

qrexec-daemon: fix read underflow when the last fd goes

Browse Source 
If no remaining fd is alive in the list, the loop breaks when i
is negative, but by then clients[-1] would have been dereferenced.
This commit is contained in:
Vincent Penquerc'h 2013-12-27 14:35:55 -05:00 committed by Marek Marczykowski-Górecki
parent bac950c5ce
commit 771be64912
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
qrexec/qrexec-daemon.c
View File

@ -246,7 +246,7 @@ void terminate_client_and_flush_data(int fd)
clients[fd].state = CLIENT_INVALID; clients[fd].state = CLIENT_INVALID;
buffer_free(&clients[fd].buffer); buffer_free(&clients[fd].buffer);
if (max_client_fd == fd) { if (max_client_fd == fd) {
for (i = fd; clients[i].state == CLIENT_INVALID && i >= 0; for (i = fd; i >= 0 && clients[i].state == CLIENT_INVALID;
i--); i--);
max_client_fd = i; max_client_fd = i;
} }