diff options
| author | kib <kib@FreeBSD.org> | 2016-07-23 08:02:45 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2016-07-23 08:02:45 +0000 |
| commit | 46354a4b7a2ac3c8657be258c0fb2ab3f73e273c (patch) | |
| tree | 24c70f08309544a76450f7caacbfc9f0db2bbe1c | |
| parent | 50a74c885b2a6cfd6445aba6536864966f6e655e (diff) | |
| download | FreeBSD-src-46354a4b7a2ac3c8657be258c0fb2ab3f73e273c.zip FreeBSD-src-46354a4b7a2ac3c8657be258c0fb2ab3f73e273c.tar.gz | |
MFC r302936:
Explicitely check for the valid range of file descriptor values.
| -rw-r--r-- | sys/kern/kern_event.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c index a0c4fa4..e4bf40b 100644 --- a/sys/kern/kern_event.c +++ b/sys/kern/kern_event.c @@ -1083,8 +1083,11 @@ kqueue_register(struct kqueue *kq, struct kevent *kev, struct thread *td, int wa findkn: if (fops->f_isfd) { KASSERT(td != NULL, ("td is NULL")); - error = fget(td, kev->ident, - cap_rights_init(&rights, CAP_EVENT), &fp); + if (kev->ident > INT_MAX) + error = EBADF; + else + error = fget(td, kev->ident, + cap_rights_init(&rights, CAP_EVENT), &fp); if (error) goto done; |
