Date: Fri, 21 Jun 2002 03:56:18 -0700 (PDT) From: Peter N Lewis <peter@stairways.com.au> To: freebsd-gnats-submit@FreeBSD.org Subject: bin/39617: traceroute fd_set allocation bug Message-ID: <200206211056.g5LAuI3i087380@www.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 39617 >Category: bin >Synopsis: traceroute fd_set allocation bug >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Jun 21 04:00:09 PDT 2002 >Closed-Date: >Last-Modified: >Originator: Peter N Lewis >Release: N/A >Organization: Stairways Software >Environment: N/A >Description: traceroute.c does this: nfds = howmany(sock + 1, NFDBITS); if ((fdsp = malloc(nfds)) == NULL) err(1, "malloc"); memset(fdsp, 0, nfds); this is not valid since the fd_set is made up of fd_mask. nfds should be: nfds = howmany(sock + 1, NFDBITS) * sizeof(fd_mask); >How-To-Repeat: Run traceroute with pre-opened files such that sock (global variable s, the receiving socket) is greater than 7. In normal operation, it is usally 3 or 4 which is why this bug remains undetected. >Fix: nfds = howmany(sock + 1, NFDBITS) * sizeof(fd_mask); >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200206211056.g5LAuI3i087380>