diff --git a/libc/bionic/__FD_chk.cpp b/libc/bionic/__FD_chk.cpp index c4b55de52..23d308475 100644 --- a/libc/bionic/__FD_chk.cpp +++ b/libc/bionic/__FD_chk.cpp @@ -30,32 +30,41 @@ #include #include "libc_logging.h" -extern "C" int __FD_ISSET_chk(int fd, fd_set* set) { +extern "C" int __FD_ISSET_chk(int fd, fd_set* set, size_t set_size) { if (__predict_false(fd < 0)) { __fortify_chk_fail("file descriptor is negative for FD_ISSET", 0); } if (__predict_false(fd >= FD_SETSIZE)) { __fortify_chk_fail("file descriptor is too big for FD_ISSET", 0); } + if (__predict_false(set_size < sizeof(fd_set))) { + __fortify_chk_fail("set is too small", 0); + } return FD_ISSET(fd, set); } -extern "C" void __FD_CLR_chk(int fd, fd_set* set) { +extern "C" void __FD_CLR_chk(int fd, fd_set* set, size_t set_size) { if (__predict_false(fd < 0)) { __fortify_chk_fail("file descriptor is negative for FD_CLR", 0); } if (__predict_false(fd >= FD_SETSIZE)) { __fortify_chk_fail("file descriptor is too big for FD_CLR", 0); } + if (__predict_false(set_size < sizeof(fd_set))) { + __fortify_chk_fail("set is too small", 0); + } FD_CLR(fd, set); } -extern "C" void __FD_SET_chk(int fd, fd_set* set) { +extern "C" void __FD_SET_chk(int fd, fd_set* set, size_t set_size) { if (__predict_false(fd < 0)) { __fortify_chk_fail("file descriptor is negative for FD_SET", 0); } if (__predict_false(fd >= FD_SETSIZE)) { __fortify_chk_fail("file descriptor is too big for FD_SET", 0); } + if (__predict_false(set_size < sizeof(fd_set))) { + __fortify_chk_fail("set is too small", 0); + } FD_SET(fd, set); } diff --git a/libc/include/sys/select.h b/libc/include/sys/select.h index c8cd8e15c..50ac22803 100644 --- a/libc/include/sys/select.h +++ b/libc/include/sys/select.h @@ -32,6 +32,7 @@ #include #include #include +#include __BEGIN_DECLS @@ -46,21 +47,19 @@ typedef struct { #define __FDELT(fd) ((fd) / __NFDBITS) #define __FDMASK(fd) (1UL << ((fd) % __NFDBITS)) #define __FDS_BITS(set) (((fd_set*)(set))->fds_bits) +#define __FD_ZERO(set) (memset(set, 0, sizeof(*(fd_set*)(set)))) + +#if defined(__BIONIC_FORTIFY) +extern void __FD_CLR_chk(int, fd_set*, size_t); +extern void __FD_SET_chk(int, fd_set*, size_t); +extern int __FD_ISSET_chk(int, fd_set*, size_t); +#define __FD_CLR(fd, set) __FD_CLR_chk(fd, set, __bos(set)) +#define __FD_SET(fd, set) __FD_SET_chk(fd, set, __bos(set)) +#define __FD_ISSET(fd, set) __FD_ISSET_chk(fd, set, __bos(set)) +#else #define __FD_CLR(fd, set) (__FDS_BITS(set)[__FDELT(fd)] &= ~__FDMASK(fd)) #define __FD_SET(fd, set) (__FDS_BITS(set)[__FDELT(fd)] |= __FDMASK(fd)) #define __FD_ISSET(fd, set) ((__FDS_BITS(set)[__FDELT(fd)] & __FDMASK(fd)) != 0) -#define __FD_ZERO(set) (__builtin_memset(set, 0, sizeof(*(fd_set*)(set)))) - -#if defined(__BIONIC_FORTIFY) -extern void __FD_CLR_chk(int, fd_set*); -extern void __FD_SET_chk(int, fd_set*); -extern int __FD_ISSET_chk(int, fd_set*); -#undef __FD_CLR -#undef __FD_SET -#undef __FD_ISSET -#define __FD_CLR(fd, set) __FD_CLR_chk(fd, set) -#define __FD_SET(fd, set) __FD_SET_chk(fd, set) -#define __FD_ISSET(fd, set) __FD_ISSET_chk(fd, set) #endif /* defined(__BIONIC_FORTIFY) */ extern int select(int, fd_set*, fd_set*, fd_set*, struct timeval*); diff --git a/tests/fortify_test.cpp b/tests/fortify_test.cpp index abe2cae5a..d514a3d10 100644 --- a/tests/fortify_test.cpp +++ b/tests/fortify_test.cpp @@ -554,6 +554,20 @@ TEST(DEATHTEST, FD_ISSET_fortified) { ASSERT_EXIT(FD_ISSET(-1, &set), testing::KilledBySignal(SIGABRT), ""); } +TEST(DEATHTEST, FD_ISSET_2_fortified) { + ::testing::FLAGS_gtest_death_test_style = "threadsafe"; + char buf[1]; + fd_set* set = (fd_set*) buf; + ASSERT_EXIT(FD_ISSET(0, set), testing::KilledBySignal(SIGABRT), ""); +} + +TEST(DEATHTEST, FD_ZERO_fortified) { + ::testing::FLAGS_gtest_death_test_style = "threadsafe"; + char buf[1]; + fd_set* set = (fd_set*) buf; + ASSERT_EXIT(FD_ZERO(set), testing::KilledBySignal(SIGABRT), ""); +} + extern "C" char* __strncat_chk(char*, const char*, size_t, size_t); extern "C" char* __strcat_chk(char*, const char*, size_t);